19 ms·

Ex-Mozilla CTO: I was grilled for three hours at US airport by border cops

594 points by vb6lives 8y ago

chuckgreenman 8y ago
I'm hoping that manufactures will start building a plausible deniability user profile you can log into while leaving your actual profile encrypted, appearing to be slack space. This kind of thuggery seems to be getting more common.
- mcv 8y ago
  Keep data off your devices during travel, and download it once you're safe. If corporate, require external activation by someone from the company before the contents of your device are restored. That way you cannot be forced to divulge any company trade secrets, because you simply don't have access to them while you're crossing the border.
  - arethuza 8y ago
    So what if you are asked if your device is in its normal state or whether you deleted any data from your device before travelling? Lying in that situation would seem like a very bad idea (I'm not a US national) - I've had a few uncomfortable experiences over the years entering the US and I certainly wouldn't want to do anything that would give cause to escalate things on their side.
    - Aromasin 8y ago
      What do they do if you say no in this situation though? Escort you home and inspect your desktop computer there? If I were to tell them that I carry a travel laptop/phone with no information on, there's little they'd be able to do about it unless that in itself was somehow made a crime.
    - tome 8y ago
      Say, "yes I wiped it in case it got lost whilst I was travelling"?
    - mcv 8y ago
      You can be as honest as you like. Or just say you don't take data with you when you travel. For security reasons. If it's work related, this is trivial to justify: company policy, trade secrets shouldn't fall in the wrong hands, etc. And even if private, phone theft and identity theft are serious concerns.
      - arethuza 8y ago
        OK and engaging full blown paranoia mode: What if they ask me to log into gmail and Office 365 (I use both) so they can see what I was trying to hide?
        mcv 8y ago
        Have a password you can't remember, so it's in your password safe which is not on this device. According to another comment, 1password has a special travel mode that supports this.
        reitanqild 8y ago
        > OK and engaging full blown paranoia mode: What if they ask me to log into gmail and Office 365 ... Doesn't sound that paranoid to me: wasn't there talk already a year ago about trying to force people to log into social media accounts when crossing the border?
    - 8note 8y ago
      yes, I'm not importing that data to the USA?
    - jrace 8y ago
      I would hope that admitting to deleting data is not admitting to a crime. I delete data all the time (old emails, texts, pictures, etc...)
  - manishsharan 8y ago
    Some companies issue "China" Laptops to their executives that they must discard after visiting China. Now I believe we all need throw away laptops and cell phones and Facebook accounts for any sort of international travel.
    - CaptainZapp 8y ago
      I'm actually wondering what happens if I'm ever asked about Facebook credentials when travelling to the US. Fact is: I don't do Facebook, nor any other Facebook product, so I'm really not able to hand over any such credentials.
      - droithomme 8y ago
        Like you I don't do Facebook and I have every Facebook domain blocked. No one except my immediate family believes I don't use Facebook and considers it an affront when I say I don't use it in response to their request "What's your Facebook?" Many people can't imagine anyone doesn't have a Facebook account. Anyone who says they don't is presumed a liar who is socially rejecting them by refusing to connect. With TSA/Customs you need to be truthful. If you don't have an account say so. If you have one and say you don't that's a felony.
        BenMorganIO 8y ago
        2019 appears to have lots of students who, although always on their phone, a good bunch don't have Facebook and consider it outdated. Instagram is the new Facebook.
        mcv 8y ago
        Instagram is still Facebook.
    - mcv 8y ago
      Most countries aren't that invasive, but it's pretty clear that a visit to the US justifies issuing a special "US" laptop now.
  - ape4 8y ago
    Can they ask for online logins?
    - mcv 8y ago
      Maybe, but you can also hand those over to a trusted party. Would be nice if email services lets you lock your email account until a trusted party unlocks it again.
      - Datenstrom 8y ago
        Why does this make me think of Harry Potter, the Fidelius Charm, and the secret keeper. Is this really what things have to come to?
    - criddell 8y ago
      For a lot of websites (like Facebook), that's a violation of their ToS and I'm not sure they can ask you to break a contract.
      - roywiggins 8y ago
        What possible interest would the government have in such a rule, and how could government agents possibly be able to know what contracts you've signed? They haven't read the Facebook ToS any more than you or I have. There was a case recently of a NASA scientist being hassled at the border for his phone. He initially refused on the basis that handing it over would compromise his obligations to his employer. It did not work. https://www.theverge.com/2017/2/12/14583124/nasa-sidd-bikkannavar-detained-cbp-phone-search-trump-travel-ban https://www.theverge.com/2017/2/12/14583124/nasa-sidd-bikkan...
      - mcv 8y ago
        > I'm not sure they can ask you to break a contract. Are allowed to? Maybe, maybe not. Will do anyway? Probably yes.
        roywiggins 8y ago
  - droithomme 8y ago
    Even that is not sufficient short of a full factory reset. It can be very difficult to impossible to clear all caches and logs, or even know about them. Once the agent has your password and takes the device into their back room for an hour, you have to assume that all data has been offloaded and the device has had an undetectable rootkit added. This gentleman's expertise is in security and encryption and now he works for Apple, a company that makes products that the US government can't always crack. He was clearly targeted in his encounter because of his current position, based on the questions they were asking. Surreptitious access to his devices is highly desirable to US intelligence services. Any device that you lose physical control of during these encounters must be presumed to be compromised and should be physically destroyed afterwards.
    - archgoon 8y ago
      > Any device that you lose physical control of during these encounters must be presumed to be compromised and should be physically destroyed afterwards. Seems unwise to destroy evidence. Find the rootkit, or have your employer or security researcher do so, prove it's existence, and sue the Government. But yes, definitely get a new laptop.
      - 0xDEFC0DE 8y ago
        I don't think that will go anywhere. How do you prove the government did it and that it wasn't on there before the encounter?
        satokema 8y ago
        Why do you need proof? Show it to the internet, there should be other examples too. It's way easier and less legally ambiguous to make people THINK you are rooting their devices than to actually do it and leave actual evidence to be found. They could even be looking for OTHER rootkits instead of installing them. I suspect there's a lot of availability bias going on here as well - how many travelers go through the US per year versus how many of them are famous ex-CTOs that get reposted on HN?
        8y ago
  - cortesoft 8y ago
    Won't this basically end up in the same situation as the one here? You will be detained for a few hours and then released? He wasn't FORCED to unlock his computer, he was just detained for three hours because he wasn't. Adding technical restrictions won't stop that.
    - Tepix 8y ago
      If you show that you cooperate yet you can't provide access to anything (because your phone is empty for example) they may treat you better or - if you're a foreigner - not deny you entry.
  - kmano8 8y ago
    For anyone who has 1Password, they have built-in support for doing this https://support.1password.com/travel-mode/ https://support.1password.com/travel-mode/
  - Zak 8y ago
    As others have mentioned, lying to the agents is illegal. This isn't: The password to this freshly wiped device is "Orwell1984". Feel free to have a look, but all you'll find is an app called "Secure Erase Free Space". This SD card I'm carrying separately? No, you can't have the password to that. Yes, I know, you can hold it indefinitely.
    - navigatesol 8y ago
      >No, you can't have the password to that. Yes, I know, you can hold it indefinitely. I have a hard time believing that an audience that finds buying a car stressful (as is often stated in Tesla threads) is going to demonstrate assertiveness to a real authority...
      - mcv 8y ago
        Of course there's a relevant xkcd for that: https://xkcd.com/538/ https://xkcd.com/538/ But that's why relying on a trusted external party, like the company you work for, to control your access to your data, is a much more effective strategy. TSA/Chinese police can threaten and bully you, but not your co-worker in a different country following company policy.
      - Zak 8y ago
        The audience here is not uniform. Andreas Gal is definitely in the target audience for HN and was able to stand up to the border agents.
      - chuckgreenman 8y ago
        People on Hacker News are also pretty likely to back ups. Getting your work laptop confiscated by agents will probably only earn you points at work. There's also a good argument to be made that the search is illegal, it's important that everyone stand up for that, even if its stressful. https://www.eff.org/deeplinks/2017/04/bill-rights-border-fourth-amendment-limits-searching-your-data-and-devices https://www.eff.org/deeplinks/2017/04/bill-rights-border-fou...
  - every 8y ago
    A "powerwashed" chromebook functions somewhat like this...
- orev 8y ago
  That will do more harm than good. In order to build such a device the feature would need to be advertised, which TSA can see just like everyone else. Then when they see such a device, it becomes incumbent on you to prove you’re not using the feature, even when you’re not using it. So you can never prove you’re not using it and therefor could be detained. You might think you have more rights if you’re in the US, but there are many regimes where you don’t have them. Also: https://xkcd.com/538/ https://xkcd.com/538/
  - geofft 8y ago
    Also, such a mechanism necessarily involves lying to law enforcement, which is generally considered a bad idea.
  - cr1895 8y ago
    >TSA Common mix up, but the agency in question is CBP, not TSA.
- z2 8y ago
  You could on Android add a dummy, unprivileged account under your name and rename your real account "Guest" or something. Not that this stops a motivated person, but it may placate a border officer who really just wants to thumb through your photos and downloads folder.
- halgir 8y ago
  This seems like a good idea, but it may land you in even more trouble. If it can be shown that you intentionally misled officers about content on your device, not merely denied questioning, you risk an obstruction of justice charge.
  - squarefoot 8y ago
    How about enforcing this by contract to shift the responsibility towards the employer, which presumably has more teeth to defend itself from abuses? Say a clause in every IT worker contract stating that when a LEO asks to unlock any device, a predefined user account must be used to log in. In the OP case, I'd hardly believe they'd send SWAT teams to Cupertino to raid Apple offices.
    - jacobush 8y ago
      Yay for getting protection from your local Lord or Knight against the King. Sad if it’s come to this.
    - voxic11 8y ago
      Contracts, or at least clauses within contracts, which require a party to break the law are not valid.
- monocasa 8y ago
  TrueCrypt had hidden volumes with plausible deniability. Aside: don't use TrueCrypt anymore for other reasons.
  - fb03 8y ago
    Btw, who picked up after TrueCrypt left? VeraCrypt?
- milomilo86 8y ago
  Couldn't you just login to the guess account on a mac? I'm assuming guess accounts cant read any data from the other existing accounts
- jniedrauer 8y ago
  > I'm hoping that manufactures will start building a plausible deniability user profile Deniable encryption can actually be very dangerous for people who are detained in places where torture is used. Even if you unlock your device, law enforcement have no proof that you have unlocked your real profile[0]. This is relevant to countries where people can be detained for not unlocking their devices, like Australia. [0]: https://en.wikipedia.org/wiki/Deniable_encryption#Drawbacks https://en.wikipedia.org/wiki/Deniable_encryption#Drawbacks
  - gruez 8y ago
    Hence why it needs to be the default. The some sort of problem kinda exists with encryption. If nobody encrypted their phones, having one immediately makes you a suspect. However, if everyone had an encrypted phone (default on ios/android), nobody would bat an eye.
- DanHulton 8y ago
  At least with iOS, you can do a factory reset before you leave, and restore it after passing through customs, and for legit reasons - you're paranoid about having your device taken from you while travelling, and you don't want thieves to be able to access your contacts, pictures, whatever. You don't have to specify that you consider customs agents thieves, that's just up to you if you wanna put that lil' spin on it. (But for real, this seems to me to be a bulletproof way to both make sure TSA can't access data on your device AND make sure you get pulled aside "randomly" for an extra-long questioning session.)
geofft 8y ago
Some discussion from yesterday: https://news.ycombinator.com/item?id=19558161 https://news.ycombinator.com/item?id=19558161 See also Andreas Gal's blog post https://medium.com/@andreasgal/no-one-should-have-to-travel-in-fear-b2bff4c460e5 https://medium.com/@andreasgal/no-one-should-have-to-travel-... , the ACLU's press release https://www.aclunc.org/news/aclu-files-complaint-department-homeland-security-over-unwarranted-interrogation-and-attempted https://www.aclunc.org/news/aclu-files-complaint-department-... , and the ACLU's formal complaint https://www.aclunc.org/docs/ACLU-NC_2019-03-28_Letter_re._Electronic_Device_Search_SFO.pdf https://www.aclunc.org/docs/ACLU-NC_2019-03-28_Letter_re._El... .
mikeash 8y ago
Quick reminder: US citizens have an absolute right to reenter the country. Customs can temporarily detain you, but they cannot refuse entry. Any threat, whether implied or stated, that they will hold you until you unlock your device is not real. They can hold your stuff indefinitely, so be prepared to lose it if you go this route, but never unlock your device based on the idea that it’s the only way to go free. Non-citizens are in a totally different boat. You can be denied entry for any reason whatsoever. Tread carefully....
- gruez 8y ago
  >Customs can temporarily detain you, but they cannot refuse entry What's the definition of "temporarily" in this case?
  - jniedrauer 8y ago
    At least 15 years[0] [0]: https://en.wikipedia.org/wiki/Saifullah_Paracha https://en.wikipedia.org/wiki/Saifullah_Paracha
    - mikeash 8y ago
      Not a US citizen, so not relevant.
    - wyldfire 8y ago
      Paracha's detention might be unjust but it's only indirectly related to this thread. He is not a US citizen.
    - Harvey-Specter 8y ago
      He's not a US citizen.
    - jefftk 8y ago
      mikeash was talking about US citizens; Paracha is Pakistani.
  - mikeash 8y ago
alex_hitchins 8y ago
The message it sends to me is, never visit America. I appreciate horrible things likely happen in my own country, but this is just disgusting.
- a012 8y ago
  Or simply just leave yours at home, buy a burner phone on arrival.
  - saiya-jin 8y ago
    For business? Yes if I have to, but thank god I don't. For leisure? I mean, seriously, who would shell their own free time and money and risk being treated like this? You get 1000x better treatment in Iran as a visitor for example. In fact, any country not currently in some sort of civil war is a better idea for a visit than US.
    - ihattendorf 8y ago
      > You get 1000x better treatment in Iran as a visitor for example. Sure, as long as you aren't LGBTQ or a woman.
    - orwin 8y ago
      People in Charleston WV are super nice (but we were caucasian so it might have helped). They might be _sightly_ surprised that someone from another country chose their place as a vacation/tourist spot however (despite amazing rivers).
  - mikepurvis 8y ago
    There's a cost to doing that. I guess it depends just how badly you need to travel to the US, but as a Canadian citizen, I see no reason to endanger myself or my family by traveling there at the current time. Walt Disney World will still be there in 2021.
    - philsnow 8y ago
AnaniasAnanas 8y ago
Something relevant from the creator of cock.li https://vc.gg/blog/so-its-been-a-while.html https://vc.gg/blog/so-its-been-a-while.html
rocqua 8y ago
It was my understanding that 5-th amendment protections against unreasonable searches are suspended at the border. That would certainly include customs at the airport. So, in a strict legal sense, demanding to unlock a device does not violate the 5th.
- Tharkun 8y ago
  As a non-American, can someone explain to me why the entire constitution wouldn't be applicable upon entering your own country? This makes no sense to me, but it seems to be the way it is?
  - roywiggins 8y ago
    It's called the "border search exception." It's not exactly that the constitution does not apply, but that certain searches are- in the context of the border- considered "reasonable", that would not be in the interior. The 4th amendment is not an absolute right- a search just has to be "reasonable;" context is a big factor into whether a search is reasonable. https://en.wikipedia.org/wiki/Border_search_exception https://en.wikipedia.org/wiki/Border_search_exception > This balance at international borders means that routine searches are "reasonable" there, and therefore do not violate the Fourth Amendment's proscription against "unreasonable searches and seizures". According to Wikipedia, there is currently a circuit split* on whether phone searches at the border require individualized suspicion, or can be conducted routinely, without falling foul of the 4th amendment. * (two sets of appeals courts have ruled in contradictory ways; these splits can be resolved by SCOTUS if they choose)
- criddell 8y ago
  And if a US citizen refuses to unlock a device, what do you think the consequences could be?
- roywiggins 8y ago
  the ACLU complaint is based on the 4th amendment right against unreasonable search. He demanded to speak to his lawyer and was thereafter allowed to leave, so his 5th amendment rights were not actually abridged. That's how the 5th amendment works, and it worked at the border. https://www.aclunc.org/docs/ACLU-NC_2019-03-28_Letter_re._Electronic_Device_Search_SFO.pdf https://www.aclunc.org/docs/ACLU-NC_2019-03-28_Letter_re._El... > CBP must ensure that its officers comply with the U.S. Constitution. Even at the border, the search of an electronic device is governed by the Fourth Amendment. To satisfy Ninth Circuit and Supreme Court law concerning electronic searches, any such search should be based on a warrant and be limited in scope to information relevant to the agency’s legitimate purpose in conducting the search. The attempted unconstitutional search of Dr. Gal’s devices illustrates that CBP’s policies do not in fact include the requirements necessary to safeguard the constitutional rights of people at the border
sschueller 8y ago
I think this would be a good opportunity for Apple's legal department to do something. Maybe help the ACLU with it's case against the Department of Homeland security.
calimac 8y ago
Mozilla is clinton’s Bitch
deleted 8y ago
[deleted]
mgkimsal 8y ago
If you're being investigated, and they have emails sent to a domain you own (for example), then search your device, but you've given them a burner device with no reference to that email account, would that be considered 'hiding' evidence?
deleted 8y ago
[deleted]
ProAm 8y ago
It would be nice if phone and laptops had removable batteries, so we literally could not turn them on until we got to our destination and buy a new battery.
- maximilianroos 8y ago
  I would worry the resources of the US government may extend to spare batteries
  - nilskidoo 8y ago
    Purchased with a hot check.
  - ProAm 8y ago
    Forcing you to unlock a laptop or phone that doesnt have a battery would fall under a different legal precedent.
    - maximilianroos 8y ago
      A forensic search would require reasonable suspicion. I'm not aware of any legal weight attached to batteries - what's the legal precedent you're thinking of?
      - ProAm 8y ago
        Having a third party install anything new (i.e. battery) to the device that wasn't present when it was confiscated would put into question the integrity of anything found on the device.
        greatpatton 8y ago
        Maybe just plug it...
- quakeguy 8y ago
  Batteries activated by the device itself could work. Like giving agreement to use/charge/manage, only when device is unlocked of course;)
tompccs 8y ago
Chilling, and Kafka-esque. As it happens I'm not convinced that the reason for his being detained had anything to do with him being a Trump critic and Democrat donor, contrary to his claims in the article, but more likely it's some lifeless bureaucrat/computer program or both putting a red flag on his file for some esoteric reason, very possibly connected to his work and writings on online privacy. The lack of transparency on the reasons for detention are the real problem. Josef K never found out the charge made against him either. (edit -spelling)
abstractbarista 8y ago
"...he clammed up, taking the Fifth, and citing constitutional rights against unwarranted searches. ...border agents told him he had no constitutional nor any legal protections, and threatened him with criminal charges should he not concede to the search. ...he was eventually allowed to leave with his belongings, the devices still locked, and no charges were pressed." My goodness! I guess those protections did exit after all! :) Guidelines: -Goons can lie to you all they want. Never budge. -Politely refuse, and remain cordial. Stay strong mentally. -Make sure your devices are turned off prior to even leaving for the airport. This is the sick reality we live in.
- vageli 8y ago
  Border agents may lie about your rights? Is there no Miranda equivalent for this type of detainment?
  - efficax 8y ago
    The border agents are in fact correct. The Supreme court has ruled that US citizens have no constitutional protections against search and seizure or basically anything else on the border of the US: https://www.aclu.org/other/constitution-100-mile-border-zone https://www.aclu.org/other/constitution-100-mile-border-zone Also police are allowed to lie about anything they want during interrogations.
    - kemitche 8y ago
      I feel like there's a difference between "lying about the facts of an investigation, including what they know or don't know, during questioning" and "misrepresenting the rights of the accused." The latter feels like a serious problem that should get rectified.
  - Dangeranger 8y ago
    There is not. Customs and Border Patrol operate under a special set of circumstances within ports of entry. You do not have the right to have an attorney present during the interrogation, you can have your personal belongings confiscated, you can be held without charge for up to four hours for any "reasonable" suspicion. These same rules apply within one hundred miles of the United States border. So if you live near the any ocean, Great Lakes, the Mexican border or Canadian border, you live under a different set of rights than the rest of America.
earenndil 8y ago
Original source: https://medium.com/@andreasgal/no-one-should-have-to-travel-in-fear-b2bff4c460e5 https://medium.com/@andreasgal/no-one-should-have-to-travel-...
- deleted 8y ago
  [deleted]
tomohawk 8y ago
The process is the punishment, and they know it. The current state is as exactly predicted by those of us who were against creating the TSA in the first place.
- ngngngng 8y ago
  Seriously. When traveling with my pregnant wife we realized that we weren't sure the scanners were safe for pregnant women, so we asked for a pat down. She was in tears by the end of the experience. We have both received many pat downs in Chinese airports that didn't bother either of us.
jillesvangurp 8y ago
Traveling internationally with encrypted data you don't want to disclose to border officials is not a good plan these days. Much safer to transfer securely via network connection. It's easy to single out the US but the reality is that most countries have pretty far reaching rules these days. E.g. the UK and Australia are hardly any safer. And forget about China, Russia, or indeed most countries with even less democratic regimes. The bottom line is that if you are not willing to unlock your device at any of the security checkpoints you will pass on your journey, you should leave it at home or just wipe it preemptively and restore over a secure connection after you arrive. In case it does get unlocked or taken from you, consider the device burned. It may come back to you with all sorts of malware. The people doing this are not thinking you are a terrorist or a child pornographer: you are being targeted and under attack by a hostile entity. Assuming otherwise would be a mistake. Wipe it, sell it on e-bay, never use it again.
- whoCaresAnymore 8y ago
  Transfering via network is only secure, if you believe that forward security exists for network traffic, which is very likely untrue. The point being: if your encrypted network traffic is captured and retained, maybe it can still be brute forced at liesure, and deduplicated for deltas only. Thus, volume is only a temporary issue, and everyone still gets to see everything eventually, and full retrospective records are still enriched, so maybe that's fine for some things, and not for others.
  - jillesvangurp 8y ago
    This is true regardless of whether you travel internationally. The converse is true as well: traveling internationally does not make it less secure to exchange information. Either way, we are well into tin foil hat territory here but if you do believe this, stop using (networked) computers.
  - mrmuagi 8y ago
    Couldn't you just generate new keys each session and keep forward security?
- 8y ago
blunte 8y ago
If another country were plan well, they could create opportunities that would attract and welcome the smart people from the US and elsewhere. If they made it economically attractive to tech businesses, they could set themselves up as a dominant leader of the world within 20-30 years, regardless of their current size. I don't know enough about Estonia to suggest they would try this, but they do seem progressive in this regard. I would vote for Netherlands, Belgium, or Portugal just because I like being in those countries.
- adventured 8y ago
  That's not actually realistic, for the exact same reason why China is such a juggernaut in tech while having almost no human rights. If it worked the way you're implying, China wouldn't be able to do what it's doing in tech at all. Things like this don't even remotely threaten US dominance in tech, because: 1) the US allows a lot of legal immigration; 2) US tech wages are far beyond anything you can make in those other locations 3) the US as a singular integrated market that is the world's largest economy, makes it impossible to compete with unless you're China, due to inherent scaling benefits 4) nowhere other than China has the capital markets to support competing with the US start-up scene properly and 5) the actual context - Andreas was let go after three hours, with his devices - isn't close to being bad enough to matter, in fact it barely registers these days (increasingly the era of domestic surveillence and censorship all around the world, from the UK to South Korea) as a very mild inconvenience on human rights, and doesn't impact ~99.999% of travelers to the US. US dominance in tech - outside of China - has only increased since 9/11, not decreased. That's despite non-stop issues of this sort, the Patriot Act, NSA spying, and so on. A rogue border search, or a hundred of them, won't dent that. That's the reality.
craigsmansion 8y ago
So really, "Apple employee gets mildly harassed at airport because of proprietary confidentially agreements" with "A terrible, terrible tragedy, non US-citizen travellers agree" as a byline. The main thing of interest here would be that maybe Mozilla should employ better hiring practices.
- lostmyoldone 8y ago
  Care to explain what you are trying to say? As you phrased your comment, it is entirely opaque to me what you intend to convey.
  - craigsmansion 8y ago
    There seems to be a lot of concern and disdain in this thread about the treatment of a US citizen. The truth however is that non US citizens in the same circumstances can be, for all intents and purposes, "disappeared". If something concerns you as a US citizen, it should be that, not comical mishaps in the security circus happening to semi-famous people. Also, Gal didn't make any sort of moral stand, he was simply defending his proprietary employer's interest. It's not the most sympathetic story. So, in the end, the article only left me wondering how people who climb the ladder inside Mozilla, ostensibly an open and free environment, can easily end up at Apple, which revels in closed and proprietary environments. Maybe Mozilla should introduce some of the values they claim to hold into the hiring and promotion process. Sorry for any confusion.
ink404 8y ago
Honestly this is one of the best use cases for multiple profiles on a device. They want entrance, just grant it to a sandboxed environment.
chvid 8y ago
This assumes that he was not picked by random but instead there is some sort of list of people to check at airports that you can be put on because of your work within IT-security. That would be a big story if that is the case. I will offer a counter-narrative which is more in line with my own experience (from other places than the US): The people who work at border control in particular in airports are bored. They are also overstaffed and given extreme discretion over the people they patrol; most of whom are non-citizen and thus have basically no rights at all. This leads to them doing work for the sake of showing they work, overreacting to the least of resistance and maybe even some games of entertainment.
- dsfyu404ed 8y ago
  They're likely not stupid enough to have a "list". They have a set of factors and probably tally up some sort of score and search everyone above X. It just so happens that anyone they wanted to put on the list will score X or above. Doing IT security probably gets you a pretty high score just by itself. Add in the fact that he was originally from Eastern Europe and there you are. I will definitely agree bored cops looking for stuff to do cause a lot of problems.
  - chvid 8y ago
    I don't disagree with you. I just don't think they have detailed information on your profession to the extend that they distinguish a software engineer from a software engineer doing security work. I think it is obvious that they profile on overall looks, race, citizen status, place of birth, travel patterns.
  - ericye16 8y ago
    They literally have a list [0] [0] https://www.nbcnews.com/politics/immigration/u-s-officials-made-list-reporters-lawyers-activists-question-border-n980301 https://www.nbcnews.com/politics/immigration/u-s-officials-m...
- RyJones 8y ago
  When I was returning from Hong Kong a few weeks ago, the agent asked what city I was born in (fine) what hospital I was born in (I remember where it used to be, but I can't remember the name) and what the "number" of the county was I grew up in. What he meant was the prefix for the license plate. Luckily I remembered it. I suspect he grew up in the area, but it was super weird; also, he was probably fairly bored.
linsomniac 8y ago
I was once randomly selected for screening at Chicago Midway, that quickly became shockingly specific: "Do you know that professor at DePaul that teaches Python?" "Do you mean Massimo Di Pierro?" "Yeah, I think that was his name." "I've met him a few times..." At this point it all seems very surreal. "He was through here a few weeks ago and had stickers on his laptop that were like yours." Ooooh...
- honkycat 8y ago
  Haha that is a name I have not seen in a while! I was a student of his at DePaul. Great guy! Massimo is awesome!
CalChris 8y ago
> Gal said the agents did take away his Global Entry pass, which allows express entry through customs, as punishment for not complying with their demands. I wonder about the legality of the CBP punitively confiscating his Global Entry pass.
- rchaud 8y ago
  In addition to that, I also wonder what punishments they can mete out to people who happen to not be high-level Apple employees with a network of powerful people who can advocate on his behalf.
  - cmurf 8y ago
    Or more likely, the success rate of threats. I suspect it's high.
jeffalyanak 8y ago
How do multi-account devices fare under these rules? What if I only have access to account A and not account B? What if unlocking the device requires a security key that I do not have with me? My intuition is that they'd still treat that as though I was impeding their search, but I wonder legally if it changes anything.
ccnafr 8y ago
Dupe: https://news.ycombinator.com/item?id=19558161 https://news.ycombinator.com/item?id=19558161
pvtmert 8y ago
In my country just refusing to unlock your phone instantly labels you as a terrorist (coup organiser) We did got past all of those (!) Ps. I live in Turkey
- stanski 8y ago
  Thanks for the reminder that it can always be worse :)
whoCaresAnymore 8y ago
How did I know, without even looking, that this was about a fucking cell phone. Which can only mean one thing: whatever you might try to imagine about mass surveillance and cell phone identifiers, take your well-reasoned, rational expectations, throw them out the window, and multiply your worst fears by a thousand. Killing people based on metadata is likely only the tip of the iceberg.
toss1 8y ago
Even as a US citizen, at this point, it is my policy to never leave the country with a device & set of data that I wouldn't mind losing at customs. Even though I have an essentially absolute right to re-enter the country, my hardware apparently does not, at least without potentially being detained for an extended period. So, burner phone and pre-wiped laptop if I need it, all powered down. If I need any files while away, store them in a secure Box or other account before crossing borders. At this point, it seems like just a necessary evil extra expense in time and money, and a good idea for other countries, although it sadly seems that the US is now the fast follower of Russia, China, etc, in terms of repressive practices.
gist 8y ago
I love the creative writing and entitlement that comes through when someone has been wronged. > Ex-Mozilla CTO Has no more or less rights than anyone else. > Techie says he was grilled for three hours Clearly click bait 'grilled for three hours'. Not questioned but 'grilled'. > "There I quickly found myself surrounded by three armed agents wearing bullet proof vests." So what? Of course they were armed. Of course they had bullet proof vests. The sole purpose of using words like that (by a writer) is to get the goat of anyone reading and have them all up in arms about INJUSTICE of one type or another. > They started to question me aggressively regarding my trip, my current employment, and my past work for Mozilla What do you think? They should act like the concierge at the Four Seasons? Of course they are going to be aggressive. That's law enforcement attitude and there is a purpose for doing so. > Given the devices were emblazoned with big red stickers reading "PROPERTY OF APPLE. PROPRIETARY," and he had signed confidentially agreements with Cupertino, Gal said he asked for permission to call his bosses and/or a lawyer to see if he would get into trouble by handing over access. This is total BS. You don't need your bosses agreement when a request is made from Law Enforcement at least not because you signed some NDA etc. Fine that he attempted and asked. But the reason is weak. > and threatened him with criminal charges should he not concede to the search Cops are allowed to lie. Not sure what the story is with border agents but possibly the same. That is how they often get info. > "My past work on encryption and online privacy is well documented, and so is my disapproval of the Trump administration and my history of significant campaign contributions to Democratic candidates," He is living in fantasy land here if he thinks there is some list of people that are being targeted for that reason. Not that it could happen but highly unlikely. It would take an entire Nixonian operation to pull that off. I think more likely since he came from a former communist state his thinking goes to this type of paranoia. > Now, Gal has enlisted the help of the ACLU to probe into the brouhaha, and determine whether his civil rights were violated. Yes everyone is looking either for more internet fame or a payout. Not sure why he needs to save the world and belabor the issue. Just move on and don't waste time. > "Furthermore, CBP’s policies lack protections for First Amendment rights by allowing interrogation and device searches that may be based on a traveler’s political beliefs, activism, nation of origin, or identity." Sounds like typical ACLU behavior for more publicity to aid fund raising (story on 60 Minutes): https://www.cbs.com/shows/60_minutes/video/cm_lFZDERHcELSPw2fEioYAgqbNOHU3t/the-chairman-aclu-genetic-revolution/ https://www.cbs.com/shows/60_minutes/video/cm_lFZDERHcELSPw2... ACLU got into high gear over Trump and sends out letters literally trying to raise money (I received one) clearly mentioning in so many words to take Trump down. Not the same organization that it used to be. On the 60 Minutes story iirc a former head of ACLU was interviewed and bothered by the current behavior.
cmrdporcupine 8y ago
Abuse of power, indeed -- but he should have let Apple's lawyers sort out the proprietary device access issue after the fact. Pretty sure as Google employees the advice to us is to cooperate fully and then make sure lawyers know about it later. It's not worth compromising your own security and freedom on behalf of a corporation.
- microtherion 8y ago
  FWIW, that's exactly what Apple tells us: > If a Customs agent asks you to power up the laptop and access content with your passwords, please comply with this request. [...] Travelers should notify their supervisor and corporate security at their first opportunity.
cylinder 8y ago
They are also cancelling ESTA for security professionals without warning and the resulting visa application gets stuck in administrative processing for months due to a security flag.
ngngngng 8y ago
This is why i'm so excited for the Librem smartphone. If i'm in complete control of the operating system, I can put measures in place to combat this. For example, a function that requires a password whenever the phone leaves a certain location (so if the police confiscate my phone, i'm sure it's locked). Or maybe a function that you can activate that makes the phone appear bricked until the power button is pushed 20 times in a row. You could activate this before going through customs.
- macintux 8y ago
  Lying to law enforcement is illegal, so subterfuges like that are perilous in their own way.
  - ngngngng 8y ago
    Would it perilous if you just plead the fifth? If you knowingly state that you don't know how to turn the phone back on, then it's a lie, but if you just plead the 5th? Also, why is it legal for them to lie to me when I can't lie to them?
    - TheRealPomax 8y ago
      It's not that it's legal, is that you have no way to hold them to account when they do.
      - megous 8y ago
        "It's not that it's legal" Unless this somehow escapes qualified immunity, it's legal for them to lie. https://en.wikipedia.org/wiki/Qualified_immunity https://en.wikipedia.org/wiki/Qualified_immunity Also you may have no way to gather your own evidence anyway.
- TheRealPomax 8y ago
  Of course, they are entirely within their right to just take your phone, and then never give it back. You "officially" have legal recourse to get it back, but in reality, you plain won't. If you _really_ care about this, travel without your phone, and travel with a minimal-account wiped laptop that runs, has some apps, and has zero work or personal data on it. Stick some steam games on it at most. Then get a burner phone once you're in the country you need to be in, let people you need to talk to know what your new temporary number is, and restore your data from a secure source that you can access using your laptop. Then when you leave, "burn" the phone and properly wipe your laptop again.
ngngngng 8y ago
Hmmm it's almost as if the land of the free has some sort of social credit score program?
southphillyman 8y ago
I'll never forget how I was strip searched coming back from Costa Rica. They went through every photo in my digital camera, ripped open all of my packaged food items, made little snide remarks to me, and ultimately made me miss my connecting flight. The whole time I was fully cooperative. Only explanation I have for the level of examination is maybe because I was a young minority returning from a random latin american country solo(?)
bravura 8y ago
Perhaps this is very cynical, but shouldn't they also be able to use airport security camera footage to figure out passwords?
ddlatham 8y ago
This is a good time to review the guide provided by the EFF: https://www.eff.org/wp/digital-privacy-us-border-2017 https://www.eff.org/wp/digital-privacy-us-border-2017
jliptzin 8y ago
I prefer increased crime over dealing with shit like this.
tango12 8y ago
Lets say he was flagged because of being vocal against the current administration; how do you think the incentive structure works for something like this to be executed? The president says I don’t like my critics. The person heading the CBP thinks they can get promoted if they show results on harassing critics. So they push that down as a goal...and somewhere a few weeks later agents on the ground actually take this up as a task to execute. Is that a realistic understanding?
nimbius 8y ago
speaking as an american, even on domestic flights it doesnt get any easier. I was once detained 45 minutes by the TSA for a laptop with a missing DVD drive. i bought it without the drive from a pawn shop to learn Arch linux on, and kept it because it was fast. I refused to unlock it. since the RealID act was passed, and im too lazy to wait at the DMV for a compliant license, I just take my passport with me for ID on domestic flights. This once cost me 30 minutes with the TSA, again, explaining why I was using a passport for a domestic flight. I refused search, refused to cooperate, and was let on the plane. security theater was fun 15 years ago but this shit show has gotten a little old. the oxycodone epidemic kills more americans than terrorism. Hell, lightning kills more americans than Al Qaeda. shoes and belts off, shuffling through the checkpoints like juden at dachau, is degrading.
jondubois 8y ago
If most people told their boss exactly what they thought, they'd get a much worse punishment than a few measly hours of interrogation... At least this guy can go cry in his Mercedes Benz afterwards. It may not be fair but it's not a problem that deserves news coverage IMO. I bet that much worse things have happened today which deserve more attention.
- rak00n 8y ago
  You need to change your job. There are better places to work where your boss won't "punish" you. Also your second argument could be applied to absolutely anything. You can always find something that deserves more attention.
charliebrownau 8y ago
Seems a bit double standards The person claims to support * Open Source * Privacy * Encryption Yet Supports and is funding the Global Socialist LEFT Next he is going to claim he supports FREE SPEECH while supporting the LEFT Then he CHOOSES to work for Apple which is :- Anti Consumer Anti privacy Anti open source Anti free speech Closed eco systems Anti repair
Friedduck 7y ago
Knowing what we know it astonishes me that people take devices with anything of value over an international border. Save everything to the cloud, or use a burner device like a It’s not worth the hassle. (And yes, I’ve read that this antagonizes border security to a certain extent, if they believe you’ve done just this.)

594 points by vb6lives 8y ago

I'm hoping that manufactures will start building a plausible deniability user profile you can log into while leaving your actual profile encrypted, appearing to be slack space. This kind of thuggery seems to be getting more common.

mcv 8y ago
Keep data off your devices during travel, and download it once you're safe. If corporate, require external activation by someone from the company before the contents of your device are restored. That way you cannot be forced to divulge any company trade secrets, because you simply don't have access to them while you're crossing the border.
- arethuza 8y ago
  So what if you are asked if your device is in its normal state or whether you deleted any data from your device before travelling? Lying in that situation would seem like a very bad idea (I'm not a US national) - I've had a few uncomfortable experiences over the years entering the US and I certainly wouldn't want to do anything that would give cause to escalate things on their side.
  - Aromasin 8y ago
    What do they do if you say no in this situation though? Escort you home and inspect your desktop computer there? If I were to tell them that I carry a travel laptop/phone with no information on, there's little they'd be able to do about it unless that in itself was somehow made a crime.
  - tome 8y ago
    Say, "yes I wiped it in case it got lost whilst I was travelling"?
  - mcv 8y ago
    You can be as honest as you like. Or just say you don't take data with you when you travel. For security reasons. If it's work related, this is trivial to justify: company policy, trade secrets shouldn't fall in the wrong hands, etc. And even if private, phone theft and identity theft are serious concerns.
    - arethuza 8y ago
      OK and engaging full blown paranoia mode: What if they ask me to log into gmail and Office 365 (I use both) so they can see what I was trying to hide?
      - mcv 8y ago
        Have a password you can't remember, so it's in your password safe which is not on this device. According to another comment, 1password has a special travel mode that supports this.
      - reitanqild 8y ago
        > OK and engaging full blown paranoia mode: What if they ask me to log into gmail and Office 365 ... Doesn't sound that paranoid to me: wasn't there talk already a year ago about trying to force people to log into social media accounts when crossing the border?
  - 8note 8y ago
    yes, I'm not importing that data to the USA?
  - jrace 8y ago
    I would hope that admitting to deleting data is not admitting to a crime. I delete data all the time (old emails, texts, pictures, etc...)
- manishsharan 8y ago
  Some companies issue "China" Laptops to their executives that they must discard after visiting China. Now I believe we all need throw away laptops and cell phones and Facebook accounts for any sort of international travel.
  - CaptainZapp 8y ago
    I'm actually wondering what happens if I'm ever asked about Facebook credentials when travelling to the US. Fact is: I don't do Facebook, nor any other Facebook product, so I'm really not able to hand over any such credentials.
    - droithomme 8y ago
      Like you I don't do Facebook and I have every Facebook domain blocked. No one except my immediate family believes I don't use Facebook and considers it an affront when I say I don't use it in response to their request "What's your Facebook?" Many people can't imagine anyone doesn't have a Facebook account. Anyone who says they don't is presumed a liar who is socially rejecting them by refusing to connect. With TSA/Customs you need to be truthful. If you don't have an account say so. If you have one and say you don't that's a felony.
      - BenMorganIO 8y ago
        2019 appears to have lots of students who, although always on their phone, a good bunch don't have Facebook and consider it outdated. Instagram is the new Facebook.
        mcv 8y ago
        Instagram is still Facebook.
  - mcv 8y ago
    Most countries aren't that invasive, but it's pretty clear that a visit to the US justifies issuing a special "US" laptop now.
- ape4 8y ago
  Can they ask for online logins?
  - mcv 8y ago
    Maybe, but you can also hand those over to a trusted party. Would be nice if email services lets you lock your email account until a trusted party unlocks it again.
    - Datenstrom 8y ago
      Why does this make me think of Harry Potter, the Fidelius Charm, and the secret keeper. Is this really what things have to come to?
  - criddell 8y ago
    For a lot of websites (like Facebook), that's a violation of their ToS and I'm not sure they can ask you to break a contract.
    - roywiggins 8y ago
      What possible interest would the government have in such a rule, and how could government agents possibly be able to know what contracts you've signed? They haven't read the Facebook ToS any more than you or I have. There was a case recently of a NASA scientist being hassled at the border for his phone. He initially refused on the basis that handing it over would compromise his obligations to his employer. It did not work. https://www.theverge.com/2017/2/12/14583124/nasa-sidd-bikkannavar-detained-cbp-phone-search-trump-travel-ban https://www.theverge.com/2017/2/12/14583124/nasa-sidd-bikkan...
    - mcv 8y ago
      > I'm not sure they can ask you to break a contract. Are allowed to? Maybe, maybe not. Will do anyway? Probably yes.
      - roywiggins 8y ago
- droithomme 8y ago
  Even that is not sufficient short of a full factory reset. It can be very difficult to impossible to clear all caches and logs, or even know about them. Once the agent has your password and takes the device into their back room for an hour, you have to assume that all data has been offloaded and the device has had an undetectable rootkit added. This gentleman's expertise is in security and encryption and now he works for Apple, a company that makes products that the US government can't always crack. He was clearly targeted in his encounter because of his current position, based on the questions they were asking. Surreptitious access to his devices is highly desirable to US intelligence services. Any device that you lose physical control of during these encounters must be presumed to be compromised and should be physically destroyed afterwards.
  - archgoon 8y ago
    > Any device that you lose physical control of during these encounters must be presumed to be compromised and should be physically destroyed afterwards. Seems unwise to destroy evidence. Find the rootkit, or have your employer or security researcher do so, prove it's existence, and sue the Government. But yes, definitely get a new laptop.
    - 0xDEFC0DE 8y ago
      I don't think that will go anywhere. How do you prove the government did it and that it wasn't on there before the encounter?
      - satokema 8y ago
        Why do you need proof? Show it to the internet, there should be other examples too. It's way easier and less legally ambiguous to make people THINK you are rooting their devices than to actually do it and leave actual evidence to be found. They could even be looking for OTHER rootkits instead of installing them. I suspect there's a lot of availability bias going on here as well - how many travelers go through the US per year versus how many of them are famous ex-CTOs that get reposted on HN?
      - 8y ago
- cortesoft 8y ago
  Won't this basically end up in the same situation as the one here? You will be detained for a few hours and then released? He wasn't FORCED to unlock his computer, he was just detained for three hours because he wasn't. Adding technical restrictions won't stop that.
  - Tepix 8y ago
    If you show that you cooperate yet you can't provide access to anything (because your phone is empty for example) they may treat you better or - if you're a foreigner - not deny you entry.
- kmano8 8y ago
  For anyone who has 1Password, they have built-in support for doing this https://support.1password.com/travel-mode/ https://support.1password.com/travel-mode/
- Zak 8y ago
  As others have mentioned, lying to the agents is illegal. This isn't: The password to this freshly wiped device is "Orwell1984". Feel free to have a look, but all you'll find is an app called "Secure Erase Free Space". This SD card I'm carrying separately? No, you can't have the password to that. Yes, I know, you can hold it indefinitely.
  - navigatesol 8y ago
    >No, you can't have the password to that. Yes, I know, you can hold it indefinitely. I have a hard time believing that an audience that finds buying a car stressful (as is often stated in Tesla threads) is going to demonstrate assertiveness to a real authority...
    - mcv 8y ago
      Of course there's a relevant xkcd for that: https://xkcd.com/538/ https://xkcd.com/538/ But that's why relying on a trusted external party, like the company you work for, to control your access to your data, is a much more effective strategy. TSA/Chinese police can threaten and bully you, but not your co-worker in a different country following company policy.
    - Zak 8y ago
      The audience here is not uniform. Andreas Gal is definitely in the target audience for HN and was able to stand up to the border agents.
    - chuckgreenman 8y ago
      People on Hacker News are also pretty likely to back ups. Getting your work laptop confiscated by agents will probably only earn you points at work. There's also a good argument to be made that the search is illegal, it's important that everyone stand up for that, even if its stressful. https://www.eff.org/deeplinks/2017/04/bill-rights-border-fourth-amendment-limits-searching-your-data-and-devices https://www.eff.org/deeplinks/2017/04/bill-rights-border-fou...
- every 8y ago
  A "powerwashed" chromebook functions somewhat like this...
orev 8y ago
That will do more harm than good. In order to build such a device the feature would need to be advertised, which TSA can see just like everyone else. Then when they see such a device, it becomes incumbent on you to prove you’re not using the feature, even when you’re not using it. So you can never prove you’re not using it and therefor could be detained. You might think you have more rights if you’re in the US, but there are many regimes where you don’t have them. Also: https://xkcd.com/538/ https://xkcd.com/538/
- geofft 8y ago
  Also, such a mechanism necessarily involves lying to law enforcement, which is generally considered a bad idea.
- cr1895 8y ago
  >TSA Common mix up, but the agency in question is CBP, not TSA.
z2 8y ago
You could on Android add a dummy, unprivileged account under your name and rename your real account "Guest" or something. Not that this stops a motivated person, but it may placate a border officer who really just wants to thumb through your photos and downloads folder.
halgir 8y ago
This seems like a good idea, but it may land you in even more trouble. If it can be shown that you intentionally misled officers about content on your device, not merely denied questioning, you risk an obstruction of justice charge.
- squarefoot 8y ago
  How about enforcing this by contract to shift the responsibility towards the employer, which presumably has more teeth to defend itself from abuses? Say a clause in every IT worker contract stating that when a LEO asks to unlock any device, a predefined user account must be used to log in. In the OP case, I'd hardly believe they'd send SWAT teams to Cupertino to raid Apple offices.
  - jacobush 8y ago
    Yay for getting protection from your local Lord or Knight against the King. Sad if it’s come to this.
  - voxic11 8y ago
    Contracts, or at least clauses within contracts, which require a party to break the law are not valid.
monocasa 8y ago
TrueCrypt had hidden volumes with plausible deniability. Aside: don't use TrueCrypt anymore for other reasons.
- fb03 8y ago
  Btw, who picked up after TrueCrypt left? VeraCrypt?
milomilo86 8y ago
Couldn't you just login to the guess account on a mac? I'm assuming guess accounts cant read any data from the other existing accounts
jniedrauer 8y ago
> I'm hoping that manufactures will start building a plausible deniability user profile Deniable encryption can actually be very dangerous for people who are detained in places where torture is used. Even if you unlock your device, law enforcement have no proof that you have unlocked your real profile[0]. This is relevant to countries where people can be detained for not unlocking their devices, like Australia. [0]: https://en.wikipedia.org/wiki/Deniable_encryption#Drawbacks https://en.wikipedia.org/wiki/Deniable_encryption#Drawbacks
- gruez 8y ago
  Hence why it needs to be the default. The some sort of problem kinda exists with encryption. If nobody encrypted their phones, having one immediately makes you a suspect. However, if everyone had an encrypted phone (default on ios/android), nobody would bat an eye.
DanHulton 8y ago
At least with iOS, you can do a factory reset before you leave, and restore it after passing through customs, and for legit reasons - you're paranoid about having your device taken from you while travelling, and you don't want thieves to be able to access your contacts, pictures, whatever. You don't have to specify that you consider customs agents thieves, that's just up to you if you wanna put that lil' spin on it. (But for real, this seems to me to be a bulletproof way to both make sure TSA can't access data on your device AND make sure you get pulled aside "randomly" for an extra-long questioning session.)

geofft 8y ago

Some discussion from yesterday: https://news.ycombinator.com/item?id=19558161 https://news.ycombinator.com/item?id=19558161 See also Andreas Gal's blog post https://medium.com/@andreasgal/no-one-should-have-to-travel-in-fear-b2bff4c460e5 https://medium.com/@andreasgal/no-one-should-have-to-travel-... , the ACLU's press release https://www.aclunc.org/news/aclu-files-complaint-department-homeland-security-over-unwarranted-interrogation-and-attempted https://www.aclunc.org/news/aclu-files-complaint-department-... , and the ACLU's formal complaint https://www.aclunc.org/docs/ACLU-NC_2019-03-28_Letter_re._Electronic_Device_Search_SFO.pdf https://www.aclunc.org/docs/ACLU-NC_2019-03-28_Letter_re._El... .

mikeash 8y ago

Quick reminder: US citizens have an absolute right to reenter the country. Customs can temporarily detain you, but they cannot refuse entry. Any threat, whether implied or stated, that they will hold you until you unlock your device is not real. They can hold your stuff indefinitely, so be prepared to lose it if you go this route, but never unlock your device based on the idea that it’s the only way to go free. Non-citizens are in a totally different boat. You can be denied entry for any reason whatsoever. Tread carefully....

gruez 8y ago
>Customs can temporarily detain you, but they cannot refuse entry What's the definition of "temporarily" in this case?
- jniedrauer 8y ago
  At least 15 years[0] [0]: https://en.wikipedia.org/wiki/Saifullah_Paracha https://en.wikipedia.org/wiki/Saifullah_Paracha
  - mikeash 8y ago
    Not a US citizen, so not relevant.
  - wyldfire 8y ago
    Paracha's detention might be unjust but it's only indirectly related to this thread. He is not a US citizen.
  - Harvey-Specter 8y ago
    He's not a US citizen.
  - jefftk 8y ago
    mikeash was talking about US citizens; Paracha is Pakistani.
- mikeash 8y ago

alex_hitchins 8y ago

The message it sends to me is, never visit America. I appreciate horrible things likely happen in my own country, but this is just disgusting.

a012 8y ago
Or simply just leave yours at home, buy a burner phone on arrival.
- saiya-jin 8y ago
  For business? Yes if I have to, but thank god I don't. For leisure? I mean, seriously, who would shell their own free time and money and risk being treated like this? You get 1000x better treatment in Iran as a visitor for example. In fact, any country not currently in some sort of civil war is a better idea for a visit than US.
  - ihattendorf 8y ago
    > You get 1000x better treatment in Iran as a visitor for example. Sure, as long as you aren't LGBTQ or a woman.
  - orwin 8y ago
    People in Charleston WV are super nice (but we were caucasian so it might have helped). They might be _sightly_ surprised that someone from another country chose their place as a vacation/tourist spot however (despite amazing rivers).
- mikepurvis 8y ago
  There's a cost to doing that. I guess it depends just how badly you need to travel to the US, but as a Canadian citizen, I see no reason to endanger myself or my family by traveling there at the current time. Walt Disney World will still be there in 2021.
  - philsnow 8y ago

AnaniasAnanas 8y ago

Something relevant from the creator of cock.li https://vc.gg/blog/so-its-been-a-while.html https://vc.gg/blog/so-its-been-a-while.html

rocqua 8y ago

It was my understanding that 5-th amendment protections against unreasonable searches are suspended at the border. That would certainly include customs at the airport. So, in a strict legal sense, demanding to unlock a device does not violate the 5th.

Tharkun 8y ago
As a non-American, can someone explain to me why the entire constitution wouldn't be applicable upon entering your own country? This makes no sense to me, but it seems to be the way it is?
- roywiggins 8y ago
  It's called the "border search exception." It's not exactly that the constitution does not apply, but that certain searches are- in the context of the border- considered "reasonable", that would not be in the interior. The 4th amendment is not an absolute right- a search just has to be "reasonable;" context is a big factor into whether a search is reasonable. https://en.wikipedia.org/wiki/Border_search_exception https://en.wikipedia.org/wiki/Border_search_exception > This balance at international borders means that routine searches are "reasonable" there, and therefore do not violate the Fourth Amendment's proscription against "unreasonable searches and seizures". According to Wikipedia, there is currently a circuit split* on whether phone searches at the border require individualized suspicion, or can be conducted routinely, without falling foul of the 4th amendment. * (two sets of appeals courts have ruled in contradictory ways; these splits can be resolved by SCOTUS if they choose)
criddell 8y ago
And if a US citizen refuses to unlock a device, what do you think the consequences could be?
roywiggins 8y ago
the ACLU complaint is based on the 4th amendment right against unreasonable search. He demanded to speak to his lawyer and was thereafter allowed to leave, so his 5th amendment rights were not actually abridged. That's how the 5th amendment works, and it worked at the border. https://www.aclunc.org/docs/ACLU-NC_2019-03-28_Letter_re._Electronic_Device_Search_SFO.pdf https://www.aclunc.org/docs/ACLU-NC_2019-03-28_Letter_re._El... > CBP must ensure that its officers comply with the U.S. Constitution. Even at the border, the search of an electronic device is governed by the Fourth Amendment. To satisfy Ninth Circuit and Supreme Court law concerning electronic searches, any such search should be based on a warrant and be limited in scope to information relevant to the agency’s legitimate purpose in conducting the search. The attempted unconstitutional search of Dr. Gal’s devices illustrates that CBP’s policies do not in fact include the requirements necessary to safeguard the constitutional rights of people at the border

sschueller 8y ago

I think this would be a good opportunity for Apple's legal department to do something. Maybe help the ACLU with it's case against the Department of Homeland security.

calimac 8y ago

Mozilla is clinton’s Bitch

deleted 8y ago

[deleted]

mgkimsal 8y ago

If you're being investigated, and they have emails sent to a domain you own (for example), then search your device, but you've given them a burner device with no reference to that email account, would that be considered 'hiding' evidence?

deleted 8y ago

[deleted]

ProAm 8y ago

It would be nice if phone and laptops had removable batteries, so we literally could not turn them on until we got to our destination and buy a new battery.

maximilianroos 8y ago
I would worry the resources of the US government may extend to spare batteries
- nilskidoo 8y ago
  Purchased with a hot check.
- ProAm 8y ago
  Forcing you to unlock a laptop or phone that doesnt have a battery would fall under a different legal precedent.
  - maximilianroos 8y ago
    A forensic search would require reasonable suspicion. I'm not aware of any legal weight attached to batteries - what's the legal precedent you're thinking of?
    - ProAm 8y ago
      Having a third party install anything new (i.e. battery) to the device that wasn't present when it was confiscated would put into question the integrity of anything found on the device.
      - greatpatton 8y ago
        Maybe just plug it...
quakeguy 8y ago
Batteries activated by the device itself could work. Like giving agreement to use/charge/manage, only when device is unlocked of course;)

tompccs 8y ago

Chilling, and Kafka-esque. As it happens I'm not convinced that the reason for his being detained had anything to do with him being a Trump critic and Democrat donor, contrary to his claims in the article, but more likely it's some lifeless bureaucrat/computer program or both putting a red flag on his file for some esoteric reason, very possibly connected to his work and writings on online privacy. The lack of transparency on the reasons for detention are the real problem. Josef K never found out the charge made against him either. (edit -spelling)

abstractbarista 8y ago

"...he clammed up, taking the Fifth, and citing constitutional rights against unwarranted searches. ...border agents told him he had no constitutional nor any legal protections, and threatened him with criminal charges should he not concede to the search. ...he was eventually allowed to leave with his belongings, the devices still locked, and no charges were pressed." My goodness! I guess those protections did exit after all! :) Guidelines: -Goons can lie to you all they want. Never budge. -Politely refuse, and remain cordial. Stay strong mentally. -Make sure your devices are turned off prior to even leaving for the airport. This is the sick reality we live in.

vageli 8y ago
Border agents may lie about your rights? Is there no Miranda equivalent for this type of detainment?
- efficax 8y ago
  The border agents are in fact correct. The Supreme court has ruled that US citizens have no constitutional protections against search and seizure or basically anything else on the border of the US: https://www.aclu.org/other/constitution-100-mile-border-zone https://www.aclu.org/other/constitution-100-mile-border-zone Also police are allowed to lie about anything they want during interrogations.
  - kemitche 8y ago
    I feel like there's a difference between "lying about the facts of an investigation, including what they know or don't know, during questioning" and "misrepresenting the rights of the accused." The latter feels like a serious problem that should get rectified.
- Dangeranger 8y ago
  There is not. Customs and Border Patrol operate under a special set of circumstances within ports of entry. You do not have the right to have an attorney present during the interrogation, you can have your personal belongings confiscated, you can be held without charge for up to four hours for any "reasonable" suspicion. These same rules apply within one hundred miles of the United States border. So if you live near the any ocean, Great Lakes, the Mexican border or Canadian border, you live under a different set of rights than the rest of America.

earenndil 8y ago

Original source: https://medium.com/@andreasgal/no-one-should-have-to-travel-in-fear-b2bff4c460e5 https://medium.com/@andreasgal/no-one-should-have-to-travel-...

deleted 8y ago
[deleted]

tomohawk 8y ago

The process is the punishment, and they know it. The current state is as exactly predicted by those of us who were against creating the TSA in the first place.

ngngngng 8y ago
Seriously. When traveling with my pregnant wife we realized that we weren't sure the scanners were safe for pregnant women, so we asked for a pat down. She was in tears by the end of the experience. We have both received many pat downs in Chinese airports that didn't bother either of us.

jillesvangurp 8y ago

Traveling internationally with encrypted data you don't want to disclose to border officials is not a good plan these days. Much safer to transfer securely via network connection. It's easy to single out the US but the reality is that most countries have pretty far reaching rules these days. E.g. the UK and Australia are hardly any safer. And forget about China, Russia, or indeed most countries with even less democratic regimes. The bottom line is that if you are not willing to unlock your device at any of the security checkpoints you will pass on your journey, you should leave it at home or just wipe it preemptively and restore over a secure connection after you arrive. In case it does get unlocked or taken from you, consider the device burned. It may come back to you with all sorts of malware. The people doing this are not thinking you are a terrorist or a child pornographer: you are being targeted and under attack by a hostile entity. Assuming otherwise would be a mistake. Wipe it, sell it on e-bay, never use it again.

whoCaresAnymore 8y ago
Transfering via network is only secure, if you believe that forward security exists for network traffic, which is very likely untrue. The point being: if your encrypted network traffic is captured and retained, maybe it can still be brute forced at liesure, and deduplicated for deltas only. Thus, volume is only a temporary issue, and everyone still gets to see everything eventually, and full retrospective records are still enriched, so maybe that's fine for some things, and not for others.
- jillesvangurp 8y ago
  This is true regardless of whether you travel internationally. The converse is true as well: traveling internationally does not make it less secure to exchange information. Either way, we are well into tin foil hat territory here but if you do believe this, stop using (networked) computers.
- mrmuagi 8y ago
  Couldn't you just generate new keys each session and keep forward security?
8y ago

blunte 8y ago

If another country were plan well, they could create opportunities that would attract and welcome the smart people from the US and elsewhere. If they made it economically attractive to tech businesses, they could set themselves up as a dominant leader of the world within 20-30 years, regardless of their current size. I don't know enough about Estonia to suggest they would try this, but they do seem progressive in this regard. I would vote for Netherlands, Belgium, or Portugal just because I like being in those countries.

adventured 8y ago
That's not actually realistic, for the exact same reason why China is such a juggernaut in tech while having almost no human rights. If it worked the way you're implying, China wouldn't be able to do what it's doing in tech at all. Things like this don't even remotely threaten US dominance in tech, because: 1) the US allows a lot of legal immigration; 2) US tech wages are far beyond anything you can make in those other locations 3) the US as a singular integrated market that is the world's largest economy, makes it impossible to compete with unless you're China, due to inherent scaling benefits 4) nowhere other than China has the capital markets to support competing with the US start-up scene properly and 5) the actual context - Andreas was let go after three hours, with his devices - isn't close to being bad enough to matter, in fact it barely registers these days (increasingly the era of domestic surveillence and censorship all around the world, from the UK to South Korea) as a very mild inconvenience on human rights, and doesn't impact ~99.999% of travelers to the US. US dominance in tech - outside of China - has only increased since 9/11, not decreased. That's despite non-stop issues of this sort, the Patriot Act, NSA spying, and so on. A rogue border search, or a hundred of them, won't dent that. That's the reality.

craigsmansion 8y ago

So really, "Apple employee gets mildly harassed at airport because of proprietary confidentially agreements" with "A terrible, terrible tragedy, non US-citizen travellers agree" as a byline. The main thing of interest here would be that maybe Mozilla should employ better hiring practices.

lostmyoldone 8y ago
Care to explain what you are trying to say? As you phrased your comment, it is entirely opaque to me what you intend to convey.
- craigsmansion 8y ago
  There seems to be a lot of concern and disdain in this thread about the treatment of a US citizen. The truth however is that non US citizens in the same circumstances can be, for all intents and purposes, "disappeared". If something concerns you as a US citizen, it should be that, not comical mishaps in the security circus happening to semi-famous people. Also, Gal didn't make any sort of moral stand, he was simply defending his proprietary employer's interest. It's not the most sympathetic story. So, in the end, the article only left me wondering how people who climb the ladder inside Mozilla, ostensibly an open and free environment, can easily end up at Apple, which revels in closed and proprietary environments. Maybe Mozilla should introduce some of the values they claim to hold into the hiring and promotion process. Sorry for any confusion.

ink404 8y ago

Honestly this is one of the best use cases for multiple profiles on a device. They want entrance, just grant it to a sandboxed environment.

chvid 8y ago

This assumes that he was not picked by random but instead there is some sort of list of people to check at airports that you can be put on because of your work within IT-security. That would be a big story if that is the case. I will offer a counter-narrative which is more in line with my own experience (from other places than the US): The people who work at border control in particular in airports are bored. They are also overstaffed and given extreme discretion over the people they patrol; most of whom are non-citizen and thus have basically no rights at all. This leads to them doing work for the sake of showing they work, overreacting to the least of resistance and maybe even some games of entertainment.

dsfyu404ed 8y ago
They're likely not stupid enough to have a "list". They have a set of factors and probably tally up some sort of score and search everyone above X. It just so happens that anyone they wanted to put on the list will score X or above. Doing IT security probably gets you a pretty high score just by itself. Add in the fact that he was originally from Eastern Europe and there you are. I will definitely agree bored cops looking for stuff to do cause a lot of problems.
- chvid 8y ago
  I don't disagree with you. I just don't think they have detailed information on your profession to the extend that they distinguish a software engineer from a software engineer doing security work. I think it is obvious that they profile on overall looks, race, citizen status, place of birth, travel patterns.
- ericye16 8y ago
  They literally have a list [0] [0] https://www.nbcnews.com/politics/immigration/u-s-officials-made-list-reporters-lawyers-activists-question-border-n980301 https://www.nbcnews.com/politics/immigration/u-s-officials-m...
RyJones 8y ago
When I was returning from Hong Kong a few weeks ago, the agent asked what city I was born in (fine) what hospital I was born in (I remember where it used to be, but I can't remember the name) and what the "number" of the county was I grew up in. What he meant was the prefix for the license plate. Luckily I remembered it. I suspect he grew up in the area, but it was super weird; also, he was probably fairly bored.

linsomniac 8y ago

I was once randomly selected for screening at Chicago Midway, that quickly became shockingly specific: "Do you know that professor at DePaul that teaches Python?" "Do you mean Massimo Di Pierro?" "Yeah, I think that was his name." "I've met him a few times..." At this point it all seems very surreal. "He was through here a few weeks ago and had stickers on his laptop that were like yours." Ooooh...

honkycat 8y ago
Haha that is a name I have not seen in a while! I was a student of his at DePaul. Great guy! Massimo is awesome!

CalChris 8y ago

> Gal said the agents did take away his Global Entry pass, which allows express entry through customs, as punishment for not complying with their demands. I wonder about the legality of the CBP punitively confiscating his Global Entry pass.

rchaud 8y ago
In addition to that, I also wonder what punishments they can mete out to people who happen to not be high-level Apple employees with a network of powerful people who can advocate on his behalf.
- cmurf 8y ago
  Or more likely, the success rate of threats. I suspect it's high.

jeffalyanak 8y ago

How do multi-account devices fare under these rules? What if I only have access to account A and not account B? What if unlocking the device requires a security key that I do not have with me? My intuition is that they'd still treat that as though I was impeding their search, but I wonder legally if it changes anything.

ccnafr 8y ago

Dupe: https://news.ycombinator.com/item?id=19558161 https://news.ycombinator.com/item?id=19558161

pvtmert 8y ago

In my country just refusing to unlock your phone instantly labels you as a terrorist (coup organiser) We did got past all of those (!) Ps. I live in Turkey

stanski 8y ago
Thanks for the reminder that it can always be worse :)

whoCaresAnymore 8y ago

How did I know, without even looking, that this was about a fucking cell phone. Which can only mean one thing: whatever you might try to imagine about mass surveillance and cell phone identifiers, take your well-reasoned, rational expectations, throw them out the window, and multiply your worst fears by a thousand. Killing people based on metadata is likely only the tip of the iceberg.

toss1 8y ago

Even as a US citizen, at this point, it is my policy to never leave the country with a device & set of data that I wouldn't mind losing at customs. Even though I have an essentially absolute right to re-enter the country, my hardware apparently does not, at least without potentially being detained for an extended period. So, burner phone and pre-wiped laptop if I need it, all powered down. If I need any files while away, store them in a secure Box or other account before crossing borders. At this point, it seems like just a necessary evil extra expense in time and money, and a good idea for other countries, although it sadly seems that the US is now the fast follower of Russia, China, etc, in terms of repressive practices.

gist 8y ago

I love the creative writing and entitlement that comes through when someone has been wronged. > Ex-Mozilla CTO Has no more or less rights than anyone else. > Techie says he was grilled for three hours Clearly click bait 'grilled for three hours'. Not questioned but 'grilled'. > "There I quickly found myself surrounded by three armed agents wearing bullet proof vests." So what? Of course they were armed. Of course they had bullet proof vests. The sole purpose of using words like that (by a writer) is to get the goat of anyone reading and have them all up in arms about INJUSTICE of one type or another. > They started to question me aggressively regarding my trip, my current employment, and my past work for Mozilla What do you think? They should act like the concierge at the Four Seasons? Of course they are going to be aggressive. That's law enforcement attitude and there is a purpose for doing so. > Given the devices were emblazoned with big red stickers reading "PROPERTY OF APPLE. PROPRIETARY," and he had signed confidentially agreements with Cupertino, Gal said he asked for permission to call his bosses and/or a lawyer to see if he would get into trouble by handing over access. This is total BS. You don't need your bosses agreement when a request is made from Law Enforcement at least not because you signed some NDA etc. Fine that he attempted and asked. But the reason is weak. > and threatened him with criminal charges should he not concede to the search Cops are allowed to lie. Not sure what the story is with border agents but possibly the same. That is how they often get info. > "My past work on encryption and online privacy is well documented, and so is my disapproval of the Trump administration and my history of significant campaign contributions to Democratic candidates," He is living in fantasy land here if he thinks there is some list of people that are being targeted for that reason. Not that it could happen but highly unlikely. It would take an entire Nixonian operation to pull that off. I think more likely since he came from a former communist state his thinking goes to this type of paranoia. > Now, Gal has enlisted the help of the ACLU to probe into the brouhaha, and determine whether his civil rights were violated. Yes everyone is looking either for more internet fame or a payout. Not sure why he needs to save the world and belabor the issue. Just move on and don't waste time. > "Furthermore, CBP’s policies lack protections for First Amendment rights by allowing interrogation and device searches that may be based on a traveler’s political beliefs, activism, nation of origin, or identity." Sounds like typical ACLU behavior for more publicity to aid fund raising (story on 60 Minutes): https://www.cbs.com/shows/60_minutes/video/cm_lFZDERHcELSPw2fEioYAgqbNOHU3t/the-chairman-aclu-genetic-revolution/ https://www.cbs.com/shows/60_minutes/video/cm_lFZDERHcELSPw2... ACLU got into high gear over Trump and sends out letters literally trying to raise money (I received one) clearly mentioning in so many words to take Trump down. Not the same organization that it used to be. On the 60 Minutes story iirc a former head of ACLU was interviewed and bothered by the current behavior.

cmrdporcupine 8y ago

Abuse of power, indeed -- but he should have let Apple's lawyers sort out the proprietary device access issue after the fact. Pretty sure as Google employees the advice to us is to cooperate fully and then make sure lawyers know about it later. It's not worth compromising your own security and freedom on behalf of a corporation.

microtherion 8y ago
FWIW, that's exactly what Apple tells us: > If a Customs agent asks you to power up the laptop and access content with your passwords, please comply with this request. [...] Travelers should notify their supervisor and corporate security at their first opportunity.

cylinder 8y ago

They are also cancelling ESTA for security professionals without warning and the resulting visa application gets stuck in administrative processing for months due to a security flag.

ngngngng 8y ago

This is why i'm so excited for the Librem smartphone. If i'm in complete control of the operating system, I can put measures in place to combat this. For example, a function that requires a password whenever the phone leaves a certain location (so if the police confiscate my phone, i'm sure it's locked). Or maybe a function that you can activate that makes the phone appear bricked until the power button is pushed 20 times in a row. You could activate this before going through customs.

macintux 8y ago
Lying to law enforcement is illegal, so subterfuges like that are perilous in their own way.
- ngngngng 8y ago
  Would it perilous if you just plead the fifth? If you knowingly state that you don't know how to turn the phone back on, then it's a lie, but if you just plead the 5th? Also, why is it legal for them to lie to me when I can't lie to them?
  - TheRealPomax 8y ago
    It's not that it's legal, is that you have no way to hold them to account when they do.
    - megous 8y ago
      "It's not that it's legal" Unless this somehow escapes qualified immunity, it's legal for them to lie. https://en.wikipedia.org/wiki/Qualified_immunity https://en.wikipedia.org/wiki/Qualified_immunity Also you may have no way to gather your own evidence anyway.
TheRealPomax 8y ago
Of course, they are entirely within their right to just take your phone, and then never give it back. You "officially" have legal recourse to get it back, but in reality, you plain won't. If you _really_ care about this, travel without your phone, and travel with a minimal-account wiped laptop that runs, has some apps, and has zero work or personal data on it. Stick some steam games on it at most. Then get a burner phone once you're in the country you need to be in, let people you need to talk to know what your new temporary number is, and restore your data from a secure source that you can access using your laptop. Then when you leave, "burn" the phone and properly wipe your laptop again.

ngngngng 8y ago

Hmmm it's almost as if the land of the free has some sort of social credit score program?

southphillyman 8y ago

I'll never forget how I was strip searched coming back from Costa Rica. They went through every photo in my digital camera, ripped open all of my packaged food items, made little snide remarks to me, and ultimately made me miss my connecting flight. The whole time I was fully cooperative. Only explanation I have for the level of examination is maybe because I was a young minority returning from a random latin american country solo(?)

bravura 8y ago

Perhaps this is very cynical, but shouldn't they also be able to use airport security camera footage to figure out passwords?

ddlatham 8y ago

This is a good time to review the guide provided by the EFF: https://www.eff.org/wp/digital-privacy-us-border-2017 https://www.eff.org/wp/digital-privacy-us-border-2017

jliptzin 8y ago

I prefer increased crime over dealing with shit like this.

tango12 8y ago

Lets say he was flagged because of being vocal against the current administration; how do you think the incentive structure works for something like this to be executed? The president says I don’t like my critics. The person heading the CBP thinks they can get promoted if they show results on harassing critics. So they push that down as a goal...and somewhere a few weeks later agents on the ground actually take this up as a task to execute. Is that a realistic understanding?

nimbius 8y ago

speaking as an american, even on domestic flights it doesnt get any easier. I was once detained 45 minutes by the TSA for a laptop with a missing DVD drive. i bought it without the drive from a pawn shop to learn Arch linux on, and kept it because it was fast. I refused to unlock it. since the RealID act was passed, and im too lazy to wait at the DMV for a compliant license, I just take my passport with me for ID on domestic flights. This once cost me 30 minutes with the TSA, again, explaining why I was using a passport for a domestic flight. I refused search, refused to cooperate, and was let on the plane. security theater was fun 15 years ago but this shit show has gotten a little old. the oxycodone epidemic kills more americans than terrorism. Hell, lightning kills more americans than Al Qaeda. shoes and belts off, shuffling through the checkpoints like juden at dachau, is degrading.

jondubois 8y ago

If most people told their boss exactly what they thought, they'd get a much worse punishment than a few measly hours of interrogation... At least this guy can go cry in his Mercedes Benz afterwards. It may not be fair but it's not a problem that deserves news coverage IMO. I bet that much worse things have happened today which deserve more attention.

rak00n 8y ago
You need to change your job. There are better places to work where your boss won't "punish" you. Also your second argument could be applied to absolutely anything. You can always find something that deserves more attention.

charliebrownau 8y ago

Seems a bit double standards The person claims to support * Open Source * Privacy * Encryption Yet Supports and is funding the Global Socialist LEFT Next he is going to claim he supports FREE SPEECH while supporting the LEFT Then he CHOOSES to work for Apple which is :- Anti Consumer Anti privacy Anti open source Anti free speech Closed eco systems Anti repair

Friedduck 7y ago

Knowing what we know it astonishes me that people take devices with anything of value over an international border. Save everything to the cloud, or use a burner device like a It’s not worth the hassle. (And yes, I’ve read that this antagonizes border security to a certain extent, if they believe you’ve done just this.)