24 ms·

Canada Border Services seizes lawyer's phone, laptop for not sharing passwords

950 points by cpncrunch 8y ago

dmix 8y ago
> He said the officer then confiscated his phone and laptop, and told him the items would be sent to a government lab which would try to crack his passwords and search his files. Hopefully they were powered down and used proper full-disk encryption.
- rahuldottech 8y ago
  Honestly, that's not something you can expect from regular non-power users. Full-disk encryption isn't enabled by default on most consumer laptops, and few regular users go out of their way to set it up.
  - briandear 8y ago
    Full disk encryption is the default on MacOS Mojave.
    - apk-d 8y ago
      It's also enabled by default on Surface Book 2 (and possibly other Surface line devices). No idea how well Bitlocker (or Windows Hello for that matter) stand up to border control.
      - oneplane 8y ago
        BitLocker security depends on TPM usage. If it's turned on a lab can crack it rather easily because the keys can be stolen via LPC.
    - dontbenebby 8y ago
      > Full disk encryption is the default on MacOS Mojave. But many people don't use a strong password/phrase.
  - steelframe 8y ago
    You don't need "full" disk encryption on Chromebook devices or Android phones. Both ship with file-based disk encryption for all user data, on-by-default for all recent devices. When I travel out of the country, I reset my phone and Chromebook to their factory defaults and then provision a decoy account. Once I'm across the border, I provision my primary account. Even if they image my devices, all they'll get is old encrypted garbage for which the key is unavailable because the key was rendered inaccessible when the device was reset to factory defaults.
    - snazz 8y ago
      They could replace part of the password-checking software with a backdoored version that would send your password off to them. Your data is protected, but the OS can still compromise it and a bad actor can replace parts of the OS (which is open source in both of your cases, making the process even easier).
      - saagarjha 8y ago
        On Chrome OS, this should cause the “your OS is unverified” warning to show up.
        snazz 8y ago
        Does that mean that every OS file is signed and checksummed like on iOS (correct me if I’m wrong)?
        gruez 8y ago
        yes, something like this: https://source.android.com/security/verifiedboot/dm-verity https://source.android.com/security/verifiedboot/dm-verity
        sowbug 8y ago
        https://www.chromium.org/chromium-os/chromiumos-design-docs/verified-boot https://www.chromium.org/chromium-os/chromiumos-design-docs/...
- Zombieball 8y ago
  Do you think its better to have an iPhone powered down or on? I am wondering if it would be possible to leverage remote wipe features, but maybe the border agents power off the device or put it in a bag / container that blocks cellular signals.
  - mikeash 8y ago
    Shouldn’t matter. The key thing is to have a strong password, and disable any biometric authentication beforehand. (You can do this by squeezing the side buttons for a few seconds until the “power off” screen appears. The phone will then require a password before reenabling biometric authentication.)
    - deleted 8y ago
      [deleted]
    - floatingatoll 8y ago
      Will that also terminate the in-memory ephemeral key that’s set up at first login to permit background app refreshes?
      - mikeash 7y ago
        Good question, I forgot about that. I'd have to read through the security guide again. I wouldn't personally worry about that, as I think the system is sufficiently robust against external attacks, but obviously other people's priorities and levels of paranoia may differ.
  - floatingatoll 8y ago
    Powered down.
  - jtms 8y ago
    Powering down if possible and then initiating a remote wipe for my supporting Apple devices (macbook, iphone) as soon as possible would be my very first move. It's possible they do have procedures in place to block connectivity to any wireless networks, but couldn't hurt to try.
- qwerty456127 8y ago
  > Hopefully they were powered down and used proper full-disk encryption. What exactly is full-disk encryption? How do I do it the way a government lab won't be able to crack it?
  - qwerty456127 7y ago
    I meant what exactly is proper full-disk encryption.
thinkingkong 8y ago
I never really understood the reason for seizing an electronic device anyway. Surely if something was important / secret enough it wouldn't be _on_ the phone. What are they looking for, exactly?
- zavi 8y ago
  Why would it not be on the phone?
  - antidesitter 8y ago
    Refer to the article of this thread.
- sys_64738 8y ago
  > What are they looking for, exactly? Probably anything incriminating. Human nature is laziness so if the guy was a baddie then there's a high chance something could be on the devices.
  - fjsolwmv 8y ago
    Most violators of the law are not "baddies", unless you believe most people are "baddies"
    - jtms 8y ago
      Most people are not baddies, but some are. True malevolence is quite real unfortunately.
      - NullPrefix 8y ago
        >Most people are not baddies According to the moral sense or The Law? As in "Three Felonies a Day". Because gestapo doesn't have too much interest in the former.
    - sys_64738 8y ago
fencepost 8y ago
He's suing to get them back and for compensation for having to "temporarily" replace them, but even if he wins he probably shouldn't trust either device in the future (possibly more so for the laptop).
- rahuldottech 8y ago
  Eh, wipe disk (or install a new one), re-install OS, and if you're super paranoid then re-flash BIOS and you should be good to go.
  - justinclift 8y ago
    That's literally useless for government sponsored persistent malware.
    - Spare_account 8y ago
      Can you expand on this? I'm curious and a little Googling didn't yield much
      - andromeduck 8y ago
        Snowden revealed that the government is capable of planting malware in peripheral firmware. So you can have a hacked bios/EFI, system controller, security chip, hard drive, SSD, GPU, WiFi/networking card/chip that is virtually impossible to detect from the main OS.
        lixtra 8y ago
        Yes, if determined the government agencies have tremendous capabilities. But will they use it at a large scale, i.e. against an arbitrary lawyer?
        pooya13 8y ago
        I’m thinking maybe this guy was flagged because he is a lawyer and might have sensitive information on a person of interest.
seanalltogether 8y ago
> Officers uncovered a customs-related offence during 38 per cent of those searches, said the agency. I really want to understand what kind of digital data is considered a customs-related offence.
- kejaed 8y ago
  There’s a reality tv show that follows the Canadian border patrol, in the couple episodes I’ve seen the agents have found emails about the person crossing actually going for work when they say for tourism or visiting family.
  - WrtCdEvrydy 8y ago
    I mean, to be honest, that's probably illegal, but I have never liked trading freedom for security.
    - pjc50 8y ago
      People love trading other people's freedom for security. Especially if it has to do with immigration.
      - noarchy 8y ago
        I'm not sure why you're being downvoted, it seems entirely correct, given the prevailing political climate.
        CrowFly 8y ago
        Because it's not the topic we're discussing.
        Fogest 8y ago
        And unfortunately this is often how they get away with doing stuff like this. People scream "my privacy!", government replies "but illegal immigrants?!?!", and people are like "ah all good then, I've got nothing to hide!". It's just so dumb, and I've heard a lot of older people especially who will say the common "Why is it a problem if you've got nothing to hide?". I think some people fail to understand the kind of data people can have stored, and how much of some people's lives are part of their digital devices. I'm sure they wouldn't want police coming into their house and searching it.
gruez 8y ago
>Wright refused, telling the officer both devices contained confidential information protected by solicitor-client privilege. >He said the officer then confiscated his phone and laptop, and told him the items would be sent to a government lab which would try to crack his passwords and search his files. Can this be used to get whatever case(es) he was defending thrown out because solicitor-client privilege was violated or parallel construction was used?
- rahuldottech 8y ago
  IANAL, but I think it might. Bot sure though.
- fjsolwmv 8y ago
  Probably only if the seized information was provably "used" for something.
- jandrewrogers 8y ago
  This and related edge cases are something that I've always wondered about e.g. where compliance would be illegal. There are a number of scenarios where one can have content on devices that it is expressly illegal to disclose to random border police. Even within a single country, there is a conflict of authority here.
  - dontbenebby 8y ago
    When I was a grad student I worried about this, since I was required to keep study participant data and student data confidential. Sounds like this lawyer arrived at the same plan I did: Refuse the request, file a lawsuit, and contact the media when released to shame the government that saw fit to violate my rights.
    - vbezhenar 8y ago
      Encrypt the data (probably easiest way is to use encrypted 7z archive), memorize the password, upload the encrypted data into any cloud storage (e.g. Google Drive) and don't care about disclosing anything on your devices.
Max-q 8y ago
> Officers uncovered a customs-related offence during 38 per cent of those searches, said the agency. This is hard for me to comprehend. Does anyone have an idea of what 38% of the phones can have stored on them, that is illegal to have when crossing the border?
- tomschlick 8y ago
  > Does anyone have an idea of what 38% of the phones can have stored on them, that is illegal to have when crossing the border? Generally it's things like text messages from friends/family/potential employers that lead agents to think the person isn't going to abide by their non-work/short term visa.
  - jameshart 8y ago
    that isn't a customs-related offence, though - that's an immigration related offence. Customs is concerned with the movement of goods, not movement of people.
    - tomschlick 8y ago
      They handle both at the border.
- lawnchair_larry 8y ago
  It’s not on 38% of phones. It’s on 38% of phones that they search, and they only do that in situations where they think they are likely to find something based on the story provided by the traveler. Usually it involves working on a tourist visa, or intent to overstay on a visa (person claims to be visiting but does not intend to leave).
  - dawnerd 8y ago
    I think I've mentioned it before on a story like this but if you watch the Border Security shows it's pretty obvious what most of the people they search end up being. Yeah it's a show but it's a pretty good slice of what they get. Here's the American version. https://www.netflix.com/title/80107514 https://www.netflix.com/title/80107514 They had a Canadian and an Australian but seems to have been removed. http://natgeotv.com/ca/border-security http://natgeotv.com/ca/border-security https://7plus.com.au/border-security-australias-front-line https://7plus.com.au/border-security-australias-front-line
shiado 8y ago
Many of the services which could be accessible from those devices are American services with data residing on American servers. I wonder if it is possible to use hacking laws as a means of dissuading border agents from looking at devices. A Canadian agent might have jurisdiction in Canada but what if the get charged under the CFAA in the USA for accessing a server they aren't legally allowed to access. Perhaps it would be possible to design a specific legal/digital service for people to install with servers all over the world as a type of legal landmine meant to punish agents searching data by using hacking laws in many jurisdictions. Think of it like copyleft for stopping agents from snooping.
- panarky 8y ago
  CBSA officers are directed to disable any internet connection and only examine content that is already stored on a device
  - bobthepanda 8y ago
    They are directed to, but what is the penalty for not following directive? South of the border this would mostly result in getting assigned to a desk job.
  - shiado 8y ago
    Perhaps one could add a specific sort of legal DRM crypto layer and then get them for anti-circumvention. No internet connection required.
    - zerocrates 7y ago
      As you might expect, law enforcement is specifically exempt from the DMCA's antcircumvention provisions. I would imagine that's true for other countries' equivalents as well. Same with the CFAA.
erik 8y ago
Digital privacy while crossing borders seems to increasingly be an issue. And I'm worried that it's not going to improve any time soon. Politicians and very rich people don't deal with border security the same way normal people do.
- mrtksn 8y ago
  That’s my main issue with the recent trend to make international travel harder. There’s a huge push to assume that travelers are criminals and all kind of inconveniences, expenses or outright humiliations are O.K.
  - tfha 8y ago
    I've certainly reduced my tourism levels on account of CBP. Can you not rip my car to shreds every time I cross the border?
    - isostatic 8y ago
      Thus reducing CO2 and working towards saving the planet
      - fao_ 8y ago
        if you took cars away from the entire population that would only account for up to 25% of the CO2 being released. So, on this small a scale it's doing almost nothing.
        saagarjha 8y ago
        A 25% reduction in CO₂ is a massive undertaking the likes of which have never been attempted before.
        fao_ 7y ago
        And yet it still is not enough. Not to mention that banning car usage will disproportionately affect poor, disabled, rural, and mentally ill people.
ccozan 8y ago
While for a laptop one can use xen ( or grub, or similar ) to default boot into a pretty boring image of, let's say, windows 10, with some fake-but-good-looking documents, photos, etc, I wonder what are the possibilities on a smartphone? Would this be possible on an Android?
- dawnerd 8y ago
  That really wont fool them though. EFF recommends against it too.
  - snazz 8y ago
    What exactly is wrong with this approach? It should get you through the border with no further suspicions, since I’m guessing they don’t have the time to be checking for hidden partitions for every traveler they pull over.
    - panarky 8y ago
      1) Because this can give officers probable cause to detain you. Just like if they find a hidden compartment in your luggage, even if there's no contraband in it, you'll be held many hours in a freezing cold room while they examine every detail of you and your property. 2) Because it could be a crime. Failure to disclose an encryption key if requested by UK Police and Customs authorities is a breach of The Terrorism Act, for which you can be arrested. 3) If they ask if you have hidden or encrypted data, and you lie about it, in the US you're now guilty of a federal crime -- even the hidden volume itself is empty or innocuous.
      - ccozan 8y ago
        Yes, true. But if you are at the border and give to the officers all what they want ( access to your laptop and phone ), why would they have further suspicions to interrogate and/or detain and deep search your devices, if you are really a clean person, dunno, white, 30-40 years, suit up, good clothing, no strange stuff in traveling history..etc.?
williesleg 8y ago
Yay Canada! Why isn't Rosie and those other leftists on this one?
albertgoeswoof 8y ago
So what’s the Canadian governments real position on this? Are individuals and companies allowed to store private and confidential data, or is all information seizable by the government without a warrant at the border? They can pick one...
- bonestamp2 8y ago
  It's not that black and white. Private and confidential data is allowed; however, customs and border patrol also have legal authority to inspect such private and confidential data when you cross the border. They do not have the right to inspect it, without warrant, elsewhere. This is the same in the US, maybe even worse in the US. Customs can inspect your home if you live within 100 miles of any border... https://www.citylab.com/equity/2018/05/who-lives-in-border-patrols-100-mile-zone-probably-you-mapped/558275/ https://www.citylab.com/equity/2018/05/who-lives-in-border-p...
richardhod 8y ago
(2012)
- glenneroo 8y ago
  > Posted: May 05, 2019 4:00 AM ET | Last Updated: 10 hours ago
  - richardhod 7y ago
    weird. thanks for the correction, some phone glitch there
- DuskStar 8y ago
  No, 2019...
DoofusOfDeath 8y ago
Is it legal to take steps to intentionally frustrate any future searches that may be done against the device by border agents, in cases where the is no other crime being covered up? For example, having a trusted remote party encrypt your data, and that party will only decrypt it once you've cleared customs?
- hyperman1 8y ago
  Why not just store the encrypted data on the internet in that case, and buy a (cheap/2nd hand/refurbished) empty laptop once over the border?
- saagarjha 8y ago
  Why wouldn’t this be legal?
  - DoofusOfDeath 8y ago
    IANAL, but in the U.S., maybe something like "conspiracy to obstruct justice". I know even less about Canadian law, so I have no idea on that side.
- scarlac 8y ago
  The problem here is that they confiscate regardless. Even when it's very clear they do not have the means to break the encryption at all. Any excuse, reasonable or not, will dissatisfy them and they'll confiscating either permanently or temporarily (both seem to have happened).
  - Zak 8y ago
    It seems to me that the best option is to keep sensitive data on encrypted removable storage devices while having light security on the internal storage of a laptop or phone. Access could then be granted to the laptop/phone, but refused for the external storage device. You want to indefinitely detain my $20 SD card if I won't give you the password? That's not a sufficient threat to convince me.
mLuby 8y ago
Fighting this is all well and good, but we should look into the near future to when brain scanning or lie detecting has improved. The fundamental problem is that governments believe they deserve to know citizens and travelers' thoughts. (Cell phone contents are a close proxy.) I disagree, and believe they can still provide adequate border and intranation security without it.
dontbenebby 8y ago
Why do border services think they can seize a device and send it to a lab? If a border officer suspected I had a hidden compartment in my suitcase could they ship it off to a special lab? I don't agree with (but can see the logic in) them copying data off your HD and trying to crack it later. But I don't understand what legal argument is to be made for arbitrarily seizing property at the border.
- FireBeyond 8y ago
  > Why do border services think they can seize a device and send it to a lab? Because they can. But the bigger question is the "should" of it.
- noarchy 8y ago
  >But I don't understand what legal argument is to be made for arbitrarily seizing property at the border. It looks an awful lot like garden variety theft, to me, which makes me question whether or not we should use their vocabulary here ("seize", versus "steal"). That said, I hesitate to wager on whether or not a court will side with the victim.
- bonestamp2 8y ago
  It used to kind of make sense when they were just searching physical property (baggage). There is a legitimate argument for wanting to stop dangerous or immoral things from entering any given country (weapons, poached ivory, foreign animals that may disrupt the ecosystem, unsafe food/drugs, etc). Then there are financial reasons for stopping some items that have tariffs or duty on them. Then there are legal reasons for stopping other things that violate the law (items that violate local copyright/patents, etc). I think most people would agree with those items above, so they have a legal right to search you and your belongings. Those same laws have been applied to computers and phones without any new thought. So, if they have to ship it off to a lab to search it because you won't share the password then they have the legal authority to do so. I don't agree with all of it, but they have the legal authority to do it.
octosphere 8y ago
These cases keep on cropping up and you see people suggesting to do some sort of technical trick like taking the hard-disk out of the laptop and carrying a TailsOS live USB flash device for your computing. Other tricks might include mailing a USB flash disk to a hotel reception with the intent of picking it up when you arrive. These are all fraught with risk and you could appear extra suspicious by doing these. Another 'trick' I see people advocating for is trying to act like a so called 'normie' and having normal average joe files on your computer and maintaining an innocent-looking browsing history where you can be seen visiting cnn.com or even cbc.ca for your news and not some left-wing conspiracy websites. The only caveat with the 'normie' method is that you will need to access your more controversial/sensitive files at some later stage, so this could mean logging into Dropbox and then downloading an encrypted Veracrypt container onto your machine and proceeding to work with those files in the privacy of your hotel/where-ever.
- joe_the_user 8y ago
  Well, I'm not sure if one wants to just call security approaches "tricks". A "trick" approach is often one that can be undone if your adversary knows about it (keeping your files hidden somewhere in your luggage would be a "trick"). A cohesive approach should be unbreachable if minimal conditions are met. If you can assure a "trustworthy" base computing environment (one that isn't keylogged etc), then having your valuable files encrypted in a remote location should work (which is the idea of tailsOS boot + a remote drive). How determined the adversary would determine how hard they might fight again you getting such a trustworthy environment. Just sayin'
  - snazz 8y ago
    The “tricked-out-bootloader” approach also seems to be brought up often: have your hard drive portioned into two sections (or even have two hard drives), then configure your bootloader to start up the non-encrypted, not suspicious partition unless you press a specific key combo at boot and enter your disk encryption password.
deleted 8y ago
[deleted]
LeonM 8y ago
I have asked this question before, but never really got a satisfiable answer: why do governments (not just USA/canada) spend these resources to check data physically at a border? It's not like you need to 'smuggle' any form of data physically. I mean, any data considered to be dangerous (like terrorist attack plans, atomic bomb designs or political inside information) can be accessed across borders via the internet. You don't need to have those on any of your devices. And even if you had the data on a laptop, how does border patrol even know what they are looking at?
- saagarjha 8y ago
  I think the goal is to get people who have incriminating evidence on their phone, however unlikely that might be for sensitive information.
- stjohnswarts 8y ago
  It's basically be because the natural tendency of government is acquire and centralize as much power as possible. Now some forms of government take longer but without constant review and concern by citizens in a democracy it will gradually move towards a despotic regime. In some countries like China it has already happened because individual freedom isn't that valuable to the general citizenry, in the USA and Europe it is moving in that direction. Citizens need to become more active and vote for parties that advocate for more freedom rather than less.
- sc11 8y ago
  It's often just security theatre meant to please the law & order voter base more than anything else. They might catch some minor criminals but as you said, if you really want to "move" data across a border, there are plenty of ways to do so without physically carrying a device. For some goals it can actually be useful, though I'm not sure if this is done during regular border checks or just in the context of asylum requests or similar: Accessing location histories, picture metadata or social media profiles on your device can be a fairly easy way to check that you're not giving them false information about where you're coming from or where you've been. This can be done automatically, so the officer doesn't need to figure out themself what they're looking at.
- 8y ago
bgitarts 8y ago
Why aren't plausible deniability passwords a feature in operating systems? Especially since many now offer full disk encryption. What would happen to these searches if plausible deniability passwords became more widely used?
- gjs278 8y ago
  probably because it doesn’t work. every hard disk tool or inspection inside the OS would reveal that the partition size doesn’t add up to the hard disk size. they would just say so what is this random blob of data sitting on the other half of this disk?
- brooksgarrett 8y ago
  I took a workshop on custom Kali builds where they specifically spoke about LUKS headers and shipping them via email/gdrive to yourself and removing them from the physical device. It renders the partition useless. This was viewed as a better alternative than something like TrueCrypt with decoy passwords since if the government can ever prove you did it then that's obstruction. With the headers gone and no local copy you can't provide what you don't possess.
  - brandon272 8y ago
    > This was viewed as a better alternative than something like TrueCrypt with decoy passwords since if the government can ever prove you did it then that's obstruction. If that qualifies as a type of legally actionable obstruction, it would seem that intentionally wiping your device before you cross a border and then reloading data onto it once you arrive at your destination would also qualify.
    - brooksgarrett 7y ago
      In one, you intentionally give false information and lead the government believe you in good faith complied. In the other, the data is inaccessible and the government is aware it is inaccessible. They can then evaluate risk and seize the device or take some other action from that knowledge. IANAL and I don't play one on TV. ETA: To complete the threat analysis, and if they seize two devices, one with a password protected key and a LUKS volume without headers? I'll take LUKS.
levlaz 8y ago
Well, at least it’s not just the US that abuses this.
pard68 8y ago
New Zealand just got a lot closer...
throw2016 8y ago
This is the definition of a police state, with law enforcement officers empowering themselves and demanding to go through your personal papers, how dehumanizing is this? What is the difference between this and the stasi or the police of any totalitarian state demanding to go through your personal papers? There is a huge difference between physically checking your laptop or phone and demanding to go through its contents and your personal data and thoughts. This is hugely invasive and dehumanizing and is the definition of totalitarianism. The word democracy by definition cannot include this. Even more disturbing is the cognitive dissonance of those who have complete moral clarity when condemning police state tactics in some third country and then stretching credulity to normalize the exact same thing when done by their own governments or 'democracies'. The is the dangerous road to totalitarianism where values are not defined by actions but actors.
KingMachiavelli 8y ago
I've always preferred having a dedicated desktop that acts as a personal server and then a small cheap laptop that I use to remotely access it. While this preference is mostly driven by capitalizing on the performance/price/size difference between desktops and laptops, it has lots of advantages when it comes to these situations. My Dell XPS 13 only has 128GB of storage so none of the data exists solely on that device; it acts mostly as a dumb terminal that I use to SSH to my desktop. I suppose upon booting the machine they could request SSH key passwords and then search my desktop but this seems unlikely. While most of the issues with these border searches are privacy/ideology based. These types of security theatre can easily be circumvented. Of course, just using Linux may get you detained for a bit which makes it all moot. Maybe having a business card saying I'm a systems administrator (which is true) would make Linux an easy explanation. If these searches increase and become normal, I think it's only a matter of time before Apple implements a cloud based 'data refuge' that would allow users to temporarily offload encrypted sensitive data to the cloud while crossing borders and traveling to countries with weak or no privacy laws.
- RandomGuyDTB 8y ago
  Do you have a citation on how using Linux can get you detained?
  - freedomben 7y ago
    I haven't heard of Linux getting people detained at border crossings, but it definitely gets you more scrutiny from other government organizations like the NSA[1]. [1] https://www.eweek.com/security/linux-lands-on-nsa-watch-list https://www.eweek.com/security/linux-lands-on-nsa-watch-list
- mef 8y ago
  related: 1Password Travel Mode https://support.1password.com/travel-mode/ https://support.1password.com/travel-mode/
- BLKNSLVR 7y ago
  My assumption is that this will become "the norm" for anyone that frequently travels across borders and deals with sensitive information. As another commenter mentioned above, in the age of the internet and almost ubiquitous connectedness to it, what need is there to transport files on a device that can be seized and searched? It's purely a limitation of the technical knowledge to make it easy to access data remotely. Package it up and sell it and you've got yourself a tidy little niche. Just watch out for governments asking for (or trying to create) backdoors. When I traveled overseas I factory reset my phone and just used a dummy gmail address on it, then put my normal account back on once properly in the country. It's a matter of managing the details required to "get everything back" with minimal time and hassle. I'm a boring person unlikely to get onto any lists, other than the fact I like the intellectual challenge of maintaining a level of privacy slightly above what the 'state' might want me to have. Too many people doing this, however, would cause a surveillance step-up to spot checking tourists / visitors mid-visit. That'll be an interesting law to try and pass.
vba 8y ago
Do you actually have to tell the officer’s your password or do you need to just unlock the device. Also, are you allowed to be there while they are searching it to see what they’re looking at/searching for?
karmakaze 8y ago
I think there could be a market for backup/wipe/restore services. Very feasible for phones leave minimally needed contact info during travel. For laptops keep the is on device and user data on external pulled and put in checked luggage. Security's annoying but lazy. Edit: removable storage on mobile could get popular as a privacy feature.
- paulkon 7y ago
  I imagine an service which makes an image of your system and launches it as a remote VM that you can access or store to an encrypted external disk. If your encrypted disk gets through then you can restore your data or boot from it. If not then you can remote into your machine in the cloud or download the image if you have access to a fast connection at your destination.
xparco 8y ago
Good. If he has nothing to hide, he should have given the passwords.
hestefisk 8y ago
It’s even worse in Australia: https://www.theguardian.com/world/2018/aug/25/sydney-airport-seizure-of-phone-and-laptop-alarming-say-privacy-groups https://www.theguardian.com/world/2018/aug/25/sydney-airport...
jrandm 8y ago
Why doesn't everyone simply refuse to share passwords, as is mentioned numerous times on various Canadian government websites? Basic search finds tons of pages from all sorts of departments https://www.canada.ca/en/sr/srb.html?q=share+password https://www.canada.ca/en/sr/srb.html?q=share+password A few samples > 95% [of polled Candians] know not to share their passwords https://www.getcybersafe.gc.ca/cnt/rsrcs/vds/nln-sft-stck-p/index-en.aspx https://www.getcybersafe.gc.ca/cnt/rsrcs/vds/nln-sft-stck-p/... > don’t share your PIN, password or personal security questions and answers with anyone, not even family members https://www.canada.ca/en/financial-consumer-agency/services/banking/online-banking.html https://www.canada.ca/en/financial-consumer-agency/services/... > If you’ve shared passwords with friends, now would be a good time to change them https://www.getcybersafe.gc.ca/cnt/blg/pst-20180913-en.aspx https://www.getcybersafe.gc.ca/cnt/blg/pst-20180913-en.aspx > Protect your password, don’t write it down or share it with anyone and change it often https://www.canada.ca/en/employment-social-development/programs/homelessness/hifis/training/administrative/module-1/thinking-security.html https://www.canada.ca/en/employment-social-development/progr... A few days of every single traveler saying "no" would force them to either begin seizing all electronic devices or to drop the entire endeavor as untenable. This problem doesn't need a technical solution beyond making sure locked devices are actually secure.
- jason0597 8y ago
  Because border police have authority
  - jrandm 7y ago
    Could you elaborate on that thought? Individuals also have the authority to assert their rights, one of which in Canada is the freedom from unreasonable search and seizure[0]. R v Fearon[1] places limitations on this exact type of search one could easily argue aren't met given the descriptions of these searches I've read. [0] https://en.wikipedia.org/wiki/Section_8_of_the_Canadian_Charter_of_Rights_and_Freedoms https://en.wikipedia.org/wiki/Section_8_of_the_Canadian_Char... [1] https://en.wikipedia.org/wiki/R_v_Fearon https://en.wikipedia.org/wiki/R_v_Fearon
JustSomeNobody 8y ago
I remember signing documents that said I (basically) would not allow anyone access to my work phone or laptop. This would put me in quite a pickle if work council wasn’t immediately available I would think. Glad I don’t travel for work outside the US.
yaiu 8y ago
Just set a duress password https://github.com/rafket/pam_duress https://github.com/rafket/pam_duress https://github.com/jcs/login_duress https://github.com/jcs/login_duress
- deleted 8y ago
  [deleted]
- justadudeama 8y ago
  Pretty sure this can count as lying to / misleading a boarder agent.
  - ultrarunner 8y ago
    Is "now, listen, you knew what we meant" a valid response, though?
jijji 7y ago
carry two phones, one used only when traveling across the border. Swap sim cards when needed.
idlewords 7y ago
Since he's a lawyer, there is a 99% chance his password is 'password123', and that it is written on a legal pad in his laptop bag.
imroot 7y ago
I really can't be the only person who travels internationally with a burner phone and burner laptop. I'll generally wipe them both sitting at the airport waiting for my flight home, just so that I can have the e-passport application up by the time that I land and go through customs. (Admittedly, I should just upgrade my TSA Precheck to Global Entry, but, I'm not even sure that I want to go through with that process).
- tiglionabbit 7y ago
  When I was working at Google I had to go through some training videos that explained that you should never bring corporate devices across the border for this very reason -- that they could be searched, thus breaking the NDA. They'll ship you a clean laptop instead.
x0054 7y ago
Next project: figure out how to add a fake user to my MacBook and only have the real HD / user boot if a key combo is placed. Apple should add users and this as an option if they care about security, to iOS.
- tiglionabbit 7y ago
  They should show just one account, but give it two passwords: a real one, and one that secretly takes you to a different account that's also customizable.
ivl 7y ago
Personal computers (and cell phones) contain more information than people could have ever imagined when polices around searches at borders became a thing. It's really unfortunate that there's no desire to respect that. You could find more from someones smartphone than you could via a search of their home with a warrant. I'm pretty glad I travel a lot and can afford a second phone as a total burner that I keep nothing on, and a new m.2 SSD and a clean install for my laptop. It's saved so much hassle, as the one time I was asked to look at them, it was an easy "Sure officer, go right ahead. I hope you're quick though, there's nothing on either."
emptybits 7y ago
If you demonstrate that government employees changed files all over your hard drive during a "search" then I wonder if recourse or compensation or legal action is possible. I understand the law permits CBSA agents to perform warrantless searches. e.g. reading the contents of your hard drive. This is, rightly, controversial. But then does the law also permit them to modify the contents of your hard drive? The act of logging in and browsing your computer will make many changes to system log files, to metadata of documents (e.g. last accessed date), etc. (Just thinking out loud about technicalities and other angles on this.)
p2t2p 8y ago
On Linux, one could use dm-crypt in plain mode with keys on number of flash drives. Good thing about keys, they look like unformatted disks, so you can send flash drives via mail in advanced. Whenever you open a laptop like this without a key inserted, it look like it has no bootloader, no OS. There is no metadata, no nothing. Get ready to have your devices seized though =).
wolco 8y ago
This is one problem asking for a sass solution. What services exist to help this situation?
- paulkon 7y ago
  if a solution were to be created, could the company be held liable for obstruction of justice via aiding and abetting? I guess this could be taken care of with an extended terms of service which lay out how the product shouldn't be used to prevent search and seizure by government officials...
  - wolco 7y ago
    Not if it is marketed as an online desktop or backup.
dijital 8y ago
Just enable guest mode. Pretty sure they're not employing top notch cyber investigators for security searches. They aren't smart enough to know the difference and it'll meet their "requirements". Fucking assholes
craftinator 8y ago
I'm planning a trip overseas sometime in the future, and I'm sorely tempted to write up some malware that will activate if someone attempts to download my hard drive in the wrong way. I'll provide the password, along with a statement that I'm not authorizing a search of the drive, and if they want to break the law they are doing so at their own expense. Any lawyers know if I would still be liable for the outcome?
Havoc 7y ago
I guess America no longer has a monopoly on that unique brand of freedom.
connorcodes 7y ago
He did the right thing... Even if it was illegal.
antpls 7y ago
I don't know the past of that lawyer, I don't know if that story is true or not, but it worries me even if I am 6000km away.
helsinki 7y ago
Something similar happened to me. One of the most uncomfortable moments of my life.
stevespang 7y ago
Almost all data can be store nowadays on a microSim, something so small it could be tucked away in a tiny place customs has no clue. Backup by using an encrypted online backup service with a VPN
ElCapitanMarkla 7y ago
Something I wish iOS had is the dummy password to unlock the phone into a sandboxes type area without any of my personal data. “Yeah sure i’ll unlock it, nope that’s all I have on there”
- Macross8299 7y ago
  I think this might backfire, though. It's the same problem with Veracrypt/LUKS hidden volumes. If they know about the sandbox capability, they could easily say "okay, now unlock the real one" if they find nothing incriminating. What happens if you _did_ unlock the real volume/sandbox in the first place and have nothing incriminating on it? Only remedy for this is having arbitrarily many sandboxes.
  - lalos 7y ago
    You could get away with it if you could download sandboxes from iCloud and be allowed to have multiple sandboxes.
notyourday 7y ago
> He said the officer then confiscated his phone and laptop, and told him the items would be sent to a government lab which would try to crack his passwords and search his files. I'm breathlessly waiting for the "We will not go to Canada! Move the conferences out of Canada!" posts.
kenneth 7y ago
I think the best solution to that is to have a "honeypot" account, at least on your laptop. Have a random account with some photos / random documents that you login to by username. Hide the main account's home folder and hope the authorities aren't savvy enough to look properly. They probably aren't. Perhaps add something to its login files that'll automatically wipe the main account data.
golemiprague 7y ago
The right to search luggage is in order to find contraband or bombs. The only reason to dig into a phone in the context of border patrol is to find information on someone, like if they want to work illegally. In that case the person should have the right to not show it and they have the right to turn them back to where they came from, but not to confiscate their phones.
Benjamin_Dobell 7y ago
It's stuff like this that makes me want to build after-market privacy-oriented Samsung firmware, that at a low level (secondary bootloader) supports dual booting. By default you'd boot into the "non-private" environment. That way if customs asks to see your device, you simply boot it up and hand it over. Could make life a lot easier for lawyers, doctors, C-level executives etc. I should note, dual-booting Android phones isn't a new concept, it's just generally performed at a higher (less secure) level. In particular, the secondary bootloader implements Loke (flashing protocol)[1], so a custom secondary bootloader could also prohibit flashing of unsigned images. [1] source, I'm the developer of Heimdall - https://github.com/Benjamin-Dobell/Heimdall https://github.com/Benjamin-Dobell/Heimdall - https://gitlab.com/BenjaminDobell/Heimdall https://gitlab.com/BenjaminDobell/Heimdall
- baroffoos 7y ago
  Thanks for your work on Heimdall btw. It the only reason my samsung s5 is still running fine years after it came out.
  - andai 7y ago
    Did you put a new Android on it, or just a bloat-free ROM? My devices became noticably slower with (official) major Android version upgrades.
    - baroffoos 7y ago
      The latest lineageOS roms. They seem to work well.
- numakerg 7y ago
  Would this system come with plausible deniability? Also, does anything like this exist for desktop operating systems?
  - bitcoinmoney 7y ago
    Yeah. You can install GRUB snd default load it to windows 10 fresh install. Put some dummy files in the desktop, make it cluttered with oictures of cats and articles about meditation. This might sound like a great idea maybe i should try it!!
adad95 7y ago
https://borderprivacy.ca/ https://borderprivacy.ca/ Its a site trying to campaign about this issue.
ada1981 7y ago
I’d love to have a second password that when I enter it automatically encrypts the phone and simultaneously loads a dummy user account. This way I can give them my password, let them look around at some basic programs, benign emails, photos, etc. and then hand me back the phone. Perhaps even a couple dummy passwors so I can keep a password like “1111” to generate a false positive if they try to brute force my phone. I’m surprised this doesn’t exist a jailbreak feature. If it does, please let me know as I’ve looked.
- iwalton3 7y ago
  The problem is if these features become common enough you will start getting asked about them. Even worse, if you aren't using them you may be asked to provide something that is impossible to provide.
  - ada1981 7y ago
    So the answer I suppose is as stated. Cloud backups and when traveling, clearing our devices.
Amygaz 7y ago
Considering he is a lawyer and a politician and civil liberties activist, he knew CBPA’s rights very well, and this is a public stunt to encourage the government to change the law. A simple search about this nick wright, reveals that this is not his first encounter with the authority. He is definitely more active about civil liberties than the average person. He has been arrested during a G20 event, and his story then sounds a bit like this one. So, we either have case of lightning striking the same person twice, or he likes to play games with the law.
- mrunkel 7y ago
  > So, we either have case of lightning striking the same person twice, or he likes to play games with the law. Or he's being targeted now because of his past activism.
sonnyblarney 7y ago
"During 38 per cent of those searches, officers uncovered evidence of a customs-related offence — which can include possessing prohibited material or undeclared goods, and money laundering, said the agency." If this is true ... wow.
drivebycomment 7y ago
Get a Chromebook, factory reset before going through security, go through the security, then login. Same for the phone for android. Nowadays both Chromebook and Android recover almost all states back fairly quickly and smoothly that you can do this with minimal hassle. i.e. There's no password to share if the devices are fresh.
deleted 7y ago
[deleted]
rjf72 7y ago
Exactly how many meaningful crimes have been prevented or busted because of this behavior? I think sacrificing liberty for security is generally a bad idea. But it seems we're increasingly sacrificing liberty for nothing, which is a rather worse idea. We're creating a dystopia for what? To get people to click on ads on one front, and on fronts like this - the pretext is mostly to stop terrorism, but that's something that should be cleanly quantifiable. So let's quantify it. How many terrorist attacks has this stopped? I think the safe ballpark is exactly 0. I also don't understand why more people don't seem to ask this question. Can governments do this is going to be an extremely difficult to answer question that few of us lack the expertise to even begin to delve into. Even for those of us with it, there are contradictory views. It seems much easier to answer should governments do this. And if they're driving a meaningful deterioration of society, as I would call the stripping of basic rights of individual privacy, and have nothing of substance to show for it - then this is something for which there is no ambiguity whatsoever.
hackermailman 7y ago
Same thing happened to me last year, flagged by Canada customs as some kind of potential sex criminal being a solo male traveller and I just gave them my unlocked phone to search through so I could get out of there after a 12hr flight. I had keepassx android 3rd party app installed to keep financial info and passport pics in case my bank cards and other things were stolen, totally forgot it was there and they didn't even ask me for the pw, returning my phone and letting me go. If I was a degenerate criminal I could have had anything in there was surprised they didn't notice it.
coldacid 7y ago
Even for Canada, standard disclaimers apply to any hardware taken by the government: Don't connect them to anything else, bleach them and burn them.
8fingerlouie 7y ago
Cases like these makes me want to take extreme precautions when traveling. I recently returned from a trip to the US, and prior to boarding (in any direction) i wiped my browser history, and logged out of iCloud, wiping all message history etc. When i arrived at my destination i simply restored from the last iCloud backup, and things "magically" reappeared. Reading the comments here made me realize that it's much more than just personal emails/notes, but also things like Uber history, frequent locations, frequent calls, etc. Basically anything you do that has a pattern to it, or matches a list of keywords. As i don't see the need nor justification for any government to profile me in detail, I'm seriously considering doing a complete wipe of the phone for my next trip, setting it up as a basic _phone_ and restore a backup once i arrive. For a laptop i would probably set it up as new, and bring an installation media with me, reinstalling when i arrive.

950 points by cpncrunch 8y ago

dmix 8y ago

> He said the officer then confiscated his phone and laptop, and told him the items would be sent to a government lab which would try to crack his passwords and search his files. Hopefully they were powered down and used proper full-disk encryption.

rahuldottech 8y ago
Honestly, that's not something you can expect from regular non-power users. Full-disk encryption isn't enabled by default on most consumer laptops, and few regular users go out of their way to set it up.
- briandear 8y ago
  Full disk encryption is the default on MacOS Mojave.
  - apk-d 8y ago
    It's also enabled by default on Surface Book 2 (and possibly other Surface line devices). No idea how well Bitlocker (or Windows Hello for that matter) stand up to border control.
    - oneplane 8y ago
      BitLocker security depends on TPM usage. If it's turned on a lab can crack it rather easily because the keys can be stolen via LPC.
  - dontbenebby 8y ago
    > Full disk encryption is the default on MacOS Mojave. But many people don't use a strong password/phrase.
- steelframe 8y ago
  You don't need "full" disk encryption on Chromebook devices or Android phones. Both ship with file-based disk encryption for all user data, on-by-default for all recent devices. When I travel out of the country, I reset my phone and Chromebook to their factory defaults and then provision a decoy account. Once I'm across the border, I provision my primary account. Even if they image my devices, all they'll get is old encrypted garbage for which the key is unavailable because the key was rendered inaccessible when the device was reset to factory defaults.
  - snazz 8y ago
    They could replace part of the password-checking software with a backdoored version that would send your password off to them. Your data is protected, but the OS can still compromise it and a bad actor can replace parts of the OS (which is open source in both of your cases, making the process even easier).
    - saagarjha 8y ago
      On Chrome OS, this should cause the “your OS is unverified” warning to show up.
      - snazz 8y ago
        Does that mean that every OS file is signed and checksummed like on iOS (correct me if I’m wrong)?
        gruez 8y ago
        yes, something like this: https://source.android.com/security/verifiedboot/dm-verity https://source.android.com/security/verifiedboot/dm-verity
        sowbug 8y ago
        https://www.chromium.org/chromium-os/chromiumos-design-docs/verified-boot https://www.chromium.org/chromium-os/chromiumos-design-docs/...
Zombieball 8y ago
Do you think its better to have an iPhone powered down or on? I am wondering if it would be possible to leverage remote wipe features, but maybe the border agents power off the device or put it in a bag / container that blocks cellular signals.
- mikeash 8y ago
  Shouldn’t matter. The key thing is to have a strong password, and disable any biometric authentication beforehand. (You can do this by squeezing the side buttons for a few seconds until the “power off” screen appears. The phone will then require a password before reenabling biometric authentication.)
  - deleted 8y ago
    [deleted]
  - floatingatoll 8y ago
    Will that also terminate the in-memory ephemeral key that’s set up at first login to permit background app refreshes?
    - mikeash 7y ago
      Good question, I forgot about that. I'd have to read through the security guide again. I wouldn't personally worry about that, as I think the system is sufficiently robust against external attacks, but obviously other people's priorities and levels of paranoia may differ.
- floatingatoll 8y ago
  Powered down.
- jtms 8y ago
  Powering down if possible and then initiating a remote wipe for my supporting Apple devices (macbook, iphone) as soon as possible would be my very first move. It's possible they do have procedures in place to block connectivity to any wireless networks, but couldn't hurt to try.
qwerty456127 8y ago
> Hopefully they were powered down and used proper full-disk encryption. What exactly is full-disk encryption? How do I do it the way a government lab won't be able to crack it?
- qwerty456127 7y ago
  I meant what exactly is proper full-disk encryption.

thinkingkong 8y ago

I never really understood the reason for seizing an electronic device anyway. Surely if something was important / secret enough it wouldn't be _on_ the phone. What are they looking for, exactly?

zavi 8y ago
Why would it not be on the phone?
- antidesitter 8y ago
  Refer to the article of this thread.
sys_64738 8y ago
> What are they looking for, exactly? Probably anything incriminating. Human nature is laziness so if the guy was a baddie then there's a high chance something could be on the devices.
- fjsolwmv 8y ago
  Most violators of the law are not "baddies", unless you believe most people are "baddies"
  - jtms 8y ago
    Most people are not baddies, but some are. True malevolence is quite real unfortunately.
    - NullPrefix 8y ago
      >Most people are not baddies According to the moral sense or The Law? As in "Three Felonies a Day". Because gestapo doesn't have too much interest in the former.
  - sys_64738 8y ago

fencepost 8y ago

He's suing to get them back and for compensation for having to "temporarily" replace them, but even if he wins he probably shouldn't trust either device in the future (possibly more so for the laptop).

rahuldottech 8y ago
Eh, wipe disk (or install a new one), re-install OS, and if you're super paranoid then re-flash BIOS and you should be good to go.
- justinclift 8y ago
  That's literally useless for government sponsored persistent malware.
  - Spare_account 8y ago
    Can you expand on this? I'm curious and a little Googling didn't yield much
    - andromeduck 8y ago
      Snowden revealed that the government is capable of planting malware in peripheral firmware. So you can have a hacked bios/EFI, system controller, security chip, hard drive, SSD, GPU, WiFi/networking card/chip that is virtually impossible to detect from the main OS.
      - lixtra 8y ago
        Yes, if determined the government agencies have tremendous capabilities. But will they use it at a large scale, i.e. against an arbitrary lawyer?
        pooya13 8y ago
        I’m thinking maybe this guy was flagged because he is a lawyer and might have sensitive information on a person of interest.

seanalltogether 8y ago

> Officers uncovered a customs-related offence during 38 per cent of those searches, said the agency. I really want to understand what kind of digital data is considered a customs-related offence.

kejaed 8y ago
There’s a reality tv show that follows the Canadian border patrol, in the couple episodes I’ve seen the agents have found emails about the person crossing actually going for work when they say for tourism or visiting family.
- WrtCdEvrydy 8y ago
  I mean, to be honest, that's probably illegal, but I have never liked trading freedom for security.
  - pjc50 8y ago
    People love trading other people's freedom for security. Especially if it has to do with immigration.
    - noarchy 8y ago
      I'm not sure why you're being downvoted, it seems entirely correct, given the prevailing political climate.
      - CrowFly 8y ago
        Because it's not the topic we're discussing.
      - Fogest 8y ago
        And unfortunately this is often how they get away with doing stuff like this. People scream "my privacy!", government replies "but illegal immigrants?!?!", and people are like "ah all good then, I've got nothing to hide!". It's just so dumb, and I've heard a lot of older people especially who will say the common "Why is it a problem if you've got nothing to hide?". I think some people fail to understand the kind of data people can have stored, and how much of some people's lives are part of their digital devices. I'm sure they wouldn't want police coming into their house and searching it.

gruez 8y ago

>Wright refused, telling the officer both devices contained confidential information protected by solicitor-client privilege. >He said the officer then confiscated his phone and laptop, and told him the items would be sent to a government lab which would try to crack his passwords and search his files. Can this be used to get whatever case(es) he was defending thrown out because solicitor-client privilege was violated or parallel construction was used?

rahuldottech 8y ago
IANAL, but I think it might. Bot sure though.
fjsolwmv 8y ago
Probably only if the seized information was provably "used" for something.
jandrewrogers 8y ago
This and related edge cases are something that I've always wondered about e.g. where compliance would be illegal. There are a number of scenarios where one can have content on devices that it is expressly illegal to disclose to random border police. Even within a single country, there is a conflict of authority here.
- dontbenebby 8y ago
  When I was a grad student I worried about this, since I was required to keep study participant data and student data confidential. Sounds like this lawyer arrived at the same plan I did: Refuse the request, file a lawsuit, and contact the media when released to shame the government that saw fit to violate my rights.
  - vbezhenar 8y ago
    Encrypt the data (probably easiest way is to use encrypted 7z archive), memorize the password, upload the encrypted data into any cloud storage (e.g. Google Drive) and don't care about disclosing anything on your devices.

Max-q 8y ago

> Officers uncovered a customs-related offence during 38 per cent of those searches, said the agency. This is hard for me to comprehend. Does anyone have an idea of what 38% of the phones can have stored on them, that is illegal to have when crossing the border?

tomschlick 8y ago
> Does anyone have an idea of what 38% of the phones can have stored on them, that is illegal to have when crossing the border? Generally it's things like text messages from friends/family/potential employers that lead agents to think the person isn't going to abide by their non-work/short term visa.
- jameshart 8y ago
  that isn't a customs-related offence, though - that's an immigration related offence. Customs is concerned with the movement of goods, not movement of people.
  - tomschlick 8y ago
    They handle both at the border.
lawnchair_larry 8y ago
It’s not on 38% of phones. It’s on 38% of phones that they search, and they only do that in situations where they think they are likely to find something based on the story provided by the traveler. Usually it involves working on a tourist visa, or intent to overstay on a visa (person claims to be visiting but does not intend to leave).
- dawnerd 8y ago
  I think I've mentioned it before on a story like this but if you watch the Border Security shows it's pretty obvious what most of the people they search end up being. Yeah it's a show but it's a pretty good slice of what they get. Here's the American version. https://www.netflix.com/title/80107514 https://www.netflix.com/title/80107514 They had a Canadian and an Australian but seems to have been removed. http://natgeotv.com/ca/border-security http://natgeotv.com/ca/border-security https://7plus.com.au/border-security-australias-front-line https://7plus.com.au/border-security-australias-front-line

shiado 8y ago

Many of the services which could be accessible from those devices are American services with data residing on American servers. I wonder if it is possible to use hacking laws as a means of dissuading border agents from looking at devices. A Canadian agent might have jurisdiction in Canada but what if the get charged under the CFAA in the USA for accessing a server they aren't legally allowed to access. Perhaps it would be possible to design a specific legal/digital service for people to install with servers all over the world as a type of legal landmine meant to punish agents searching data by using hacking laws in many jurisdictions. Think of it like copyleft for stopping agents from snooping.

panarky 8y ago
CBSA officers are directed to disable any internet connection and only examine content that is already stored on a device
- bobthepanda 8y ago
  They are directed to, but what is the penalty for not following directive? South of the border this would mostly result in getting assigned to a desk job.
- shiado 8y ago
  Perhaps one could add a specific sort of legal DRM crypto layer and then get them for anti-circumvention. No internet connection required.
  - zerocrates 7y ago
    As you might expect, law enforcement is specifically exempt from the DMCA's antcircumvention provisions. I would imagine that's true for other countries' equivalents as well. Same with the CFAA.

erik 8y ago

Digital privacy while crossing borders seems to increasingly be an issue. And I'm worried that it's not going to improve any time soon. Politicians and very rich people don't deal with border security the same way normal people do.

mrtksn 8y ago
That’s my main issue with the recent trend to make international travel harder. There’s a huge push to assume that travelers are criminals and all kind of inconveniences, expenses or outright humiliations are O.K.
- tfha 8y ago
  I've certainly reduced my tourism levels on account of CBP. Can you not rip my car to shreds every time I cross the border?
  - isostatic 8y ago
    Thus reducing CO2 and working towards saving the planet
    - fao_ 8y ago
      if you took cars away from the entire population that would only account for up to 25% of the CO2 being released. So, on this small a scale it's doing almost nothing.
      - saagarjha 8y ago
        A 25% reduction in CO₂ is a massive undertaking the likes of which have never been attempted before.
        fao_ 7y ago
        And yet it still is not enough. Not to mention that banning car usage will disproportionately affect poor, disabled, rural, and mentally ill people.

ccozan 8y ago

While for a laptop one can use xen ( or grub, or similar ) to default boot into a pretty boring image of, let's say, windows 10, with some fake-but-good-looking documents, photos, etc, I wonder what are the possibilities on a smartphone? Would this be possible on an Android?

dawnerd 8y ago
That really wont fool them though. EFF recommends against it too.
- snazz 8y ago
  What exactly is wrong with this approach? It should get you through the border with no further suspicions, since I’m guessing they don’t have the time to be checking for hidden partitions for every traveler they pull over.
  - panarky 8y ago
    1) Because this can give officers probable cause to detain you. Just like if they find a hidden compartment in your luggage, even if there's no contraband in it, you'll be held many hours in a freezing cold room while they examine every detail of you and your property. 2) Because it could be a crime. Failure to disclose an encryption key if requested by UK Police and Customs authorities is a breach of The Terrorism Act, for which you can be arrested. 3) If they ask if you have hidden or encrypted data, and you lie about it, in the US you're now guilty of a federal crime -- even the hidden volume itself is empty or innocuous.
    - ccozan 8y ago
      Yes, true. But if you are at the border and give to the officers all what they want ( access to your laptop and phone ), why would they have further suspicions to interrogate and/or detain and deep search your devices, if you are really a clean person, dunno, white, 30-40 years, suit up, good clothing, no strange stuff in traveling history..etc.?

williesleg 8y ago

Yay Canada! Why isn't Rosie and those other leftists on this one?

albertgoeswoof 8y ago

So what’s the Canadian governments real position on this? Are individuals and companies allowed to store private and confidential data, or is all information seizable by the government without a warrant at the border? They can pick one...

bonestamp2 8y ago
It's not that black and white. Private and confidential data is allowed; however, customs and border patrol also have legal authority to inspect such private and confidential data when you cross the border. They do not have the right to inspect it, without warrant, elsewhere. This is the same in the US, maybe even worse in the US. Customs can inspect your home if you live within 100 miles of any border... https://www.citylab.com/equity/2018/05/who-lives-in-border-patrols-100-mile-zone-probably-you-mapped/558275/ https://www.citylab.com/equity/2018/05/who-lives-in-border-p...

richardhod 8y ago

(2012)

glenneroo 8y ago
> Posted: May 05, 2019 4:00 AM ET | Last Updated: 10 hours ago
- richardhod 7y ago
  weird. thanks for the correction, some phone glitch there
DuskStar 8y ago
No, 2019...

DoofusOfDeath 8y ago

Is it legal to take steps to intentionally frustrate any future searches that may be done against the device by border agents, in cases where the is no other crime being covered up? For example, having a trusted remote party encrypt your data, and that party will only decrypt it once you've cleared customs?

hyperman1 8y ago
Why not just store the encrypted data on the internet in that case, and buy a (cheap/2nd hand/refurbished) empty laptop once over the border?
saagarjha 8y ago
Why wouldn’t this be legal?
- DoofusOfDeath 8y ago
  IANAL, but in the U.S., maybe something like "conspiracy to obstruct justice". I know even less about Canadian law, so I have no idea on that side.
scarlac 8y ago
The problem here is that they confiscate regardless. Even when it's very clear they do not have the means to break the encryption at all. Any excuse, reasonable or not, will dissatisfy them and they'll confiscating either permanently or temporarily (both seem to have happened).
- Zak 8y ago
  It seems to me that the best option is to keep sensitive data on encrypted removable storage devices while having light security on the internal storage of a laptop or phone. Access could then be granted to the laptop/phone, but refused for the external storage device. You want to indefinitely detain my $20 SD card if I won't give you the password? That's not a sufficient threat to convince me.

mLuby 8y ago

Fighting this is all well and good, but we should look into the near future to when brain scanning or lie detecting has improved. The fundamental problem is that governments believe they deserve to know citizens and travelers' thoughts. (Cell phone contents are a close proxy.) I disagree, and believe they can still provide adequate border and intranation security without it.

dontbenebby 8y ago

Why do border services think they can seize a device and send it to a lab? If a border officer suspected I had a hidden compartment in my suitcase could they ship it off to a special lab? I don't agree with (but can see the logic in) them copying data off your HD and trying to crack it later. But I don't understand what legal argument is to be made for arbitrarily seizing property at the border.

FireBeyond 8y ago
> Why do border services think they can seize a device and send it to a lab? Because they can. But the bigger question is the "should" of it.
noarchy 8y ago
>But I don't understand what legal argument is to be made for arbitrarily seizing property at the border. It looks an awful lot like garden variety theft, to me, which makes me question whether or not we should use their vocabulary here ("seize", versus "steal"). That said, I hesitate to wager on whether or not a court will side with the victim.
bonestamp2 8y ago
It used to kind of make sense when they were just searching physical property (baggage). There is a legitimate argument for wanting to stop dangerous or immoral things from entering any given country (weapons, poached ivory, foreign animals that may disrupt the ecosystem, unsafe food/drugs, etc). Then there are financial reasons for stopping some items that have tariffs or duty on them. Then there are legal reasons for stopping other things that violate the law (items that violate local copyright/patents, etc). I think most people would agree with those items above, so they have a legal right to search you and your belongings. Those same laws have been applied to computers and phones without any new thought. So, if they have to ship it off to a lab to search it because you won't share the password then they have the legal authority to do so. I don't agree with all of it, but they have the legal authority to do it.

octosphere 8y ago

These cases keep on cropping up and you see people suggesting to do some sort of technical trick like taking the hard-disk out of the laptop and carrying a TailsOS live USB flash device for your computing. Other tricks might include mailing a USB flash disk to a hotel reception with the intent of picking it up when you arrive. These are all fraught with risk and you could appear extra suspicious by doing these. Another 'trick' I see people advocating for is trying to act like a so called 'normie' and having normal average joe files on your computer and maintaining an innocent-looking browsing history where you can be seen visiting cnn.com or even cbc.ca for your news and not some left-wing conspiracy websites. The only caveat with the 'normie' method is that you will need to access your more controversial/sensitive files at some later stage, so this could mean logging into Dropbox and then downloading an encrypted Veracrypt container onto your machine and proceeding to work with those files in the privacy of your hotel/where-ever.

joe_the_user 8y ago
Well, I'm not sure if one wants to just call security approaches "tricks". A "trick" approach is often one that can be undone if your adversary knows about it (keeping your files hidden somewhere in your luggage would be a "trick"). A cohesive approach should be unbreachable if minimal conditions are met. If you can assure a "trustworthy" base computing environment (one that isn't keylogged etc), then having your valuable files encrypted in a remote location should work (which is the idea of tailsOS boot + a remote drive). How determined the adversary would determine how hard they might fight again you getting such a trustworthy environment. Just sayin'
- snazz 8y ago
  The “tricked-out-bootloader” approach also seems to be brought up often: have your hard drive portioned into two sections (or even have two hard drives), then configure your bootloader to start up the non-encrypted, not suspicious partition unless you press a specific key combo at boot and enter your disk encryption password.

deleted 8y ago

[deleted]

LeonM 8y ago

I have asked this question before, but never really got a satisfiable answer: why do governments (not just USA/canada) spend these resources to check data physically at a border? It's not like you need to 'smuggle' any form of data physically. I mean, any data considered to be dangerous (like terrorist attack plans, atomic bomb designs or political inside information) can be accessed across borders via the internet. You don't need to have those on any of your devices. And even if you had the data on a laptop, how does border patrol even know what they are looking at?

saagarjha 8y ago
I think the goal is to get people who have incriminating evidence on their phone, however unlikely that might be for sensitive information.
stjohnswarts 8y ago
It's basically be because the natural tendency of government is acquire and centralize as much power as possible. Now some forms of government take longer but without constant review and concern by citizens in a democracy it will gradually move towards a despotic regime. In some countries like China it has already happened because individual freedom isn't that valuable to the general citizenry, in the USA and Europe it is moving in that direction. Citizens need to become more active and vote for parties that advocate for more freedom rather than less.
sc11 8y ago
It's often just security theatre meant to please the law & order voter base more than anything else. They might catch some minor criminals but as you said, if you really want to "move" data across a border, there are plenty of ways to do so without physically carrying a device. For some goals it can actually be useful, though I'm not sure if this is done during regular border checks or just in the context of asylum requests or similar: Accessing location histories, picture metadata or social media profiles on your device can be a fairly easy way to check that you're not giving them false information about where you're coming from or where you've been. This can be done automatically, so the officer doesn't need to figure out themself what they're looking at.
8y ago

bgitarts 8y ago

Why aren't plausible deniability passwords a feature in operating systems? Especially since many now offer full disk encryption. What would happen to these searches if plausible deniability passwords became more widely used?

gjs278 8y ago
probably because it doesn’t work. every hard disk tool or inspection inside the OS would reveal that the partition size doesn’t add up to the hard disk size. they would just say so what is this random blob of data sitting on the other half of this disk?
brooksgarrett 8y ago
I took a workshop on custom Kali builds where they specifically spoke about LUKS headers and shipping them via email/gdrive to yourself and removing them from the physical device. It renders the partition useless. This was viewed as a better alternative than something like TrueCrypt with decoy passwords since if the government can ever prove you did it then that's obstruction. With the headers gone and no local copy you can't provide what you don't possess.
- brandon272 8y ago
  > This was viewed as a better alternative than something like TrueCrypt with decoy passwords since if the government can ever prove you did it then that's obstruction. If that qualifies as a type of legally actionable obstruction, it would seem that intentionally wiping your device before you cross a border and then reloading data onto it once you arrive at your destination would also qualify.
  - brooksgarrett 7y ago
    In one, you intentionally give false information and lead the government believe you in good faith complied. In the other, the data is inaccessible and the government is aware it is inaccessible. They can then evaluate risk and seize the device or take some other action from that knowledge. IANAL and I don't play one on TV. ETA: To complete the threat analysis, and if they seize two devices, one with a password protected key and a LUKS volume without headers? I'll take LUKS.

levlaz 8y ago

Well, at least it’s not just the US that abuses this.

pard68 8y ago

New Zealand just got a lot closer...

throw2016 8y ago

This is the definition of a police state, with law enforcement officers empowering themselves and demanding to go through your personal papers, how dehumanizing is this? What is the difference between this and the stasi or the police of any totalitarian state demanding to go through your personal papers? There is a huge difference between physically checking your laptop or phone and demanding to go through its contents and your personal data and thoughts. This is hugely invasive and dehumanizing and is the definition of totalitarianism. The word democracy by definition cannot include this. Even more disturbing is the cognitive dissonance of those who have complete moral clarity when condemning police state tactics in some third country and then stretching credulity to normalize the exact same thing when done by their own governments or 'democracies'. The is the dangerous road to totalitarianism where values are not defined by actions but actors.

KingMachiavelli 8y ago

I've always preferred having a dedicated desktop that acts as a personal server and then a small cheap laptop that I use to remotely access it. While this preference is mostly driven by capitalizing on the performance/price/size difference between desktops and laptops, it has lots of advantages when it comes to these situations. My Dell XPS 13 only has 128GB of storage so none of the data exists solely on that device; it acts mostly as a dumb terminal that I use to SSH to my desktop. I suppose upon booting the machine they could request SSH key passwords and then search my desktop but this seems unlikely. While most of the issues with these border searches are privacy/ideology based. These types of security theatre can easily be circumvented. Of course, just using Linux may get you detained for a bit which makes it all moot. Maybe having a business card saying I'm a systems administrator (which is true) would make Linux an easy explanation. If these searches increase and become normal, I think it's only a matter of time before Apple implements a cloud based 'data refuge' that would allow users to temporarily offload encrypted sensitive data to the cloud while crossing borders and traveling to countries with weak or no privacy laws.

RandomGuyDTB 8y ago
Do you have a citation on how using Linux can get you detained?
- freedomben 7y ago
  I haven't heard of Linux getting people detained at border crossings, but it definitely gets you more scrutiny from other government organizations like the NSA[1]. [1] https://www.eweek.com/security/linux-lands-on-nsa-watch-list https://www.eweek.com/security/linux-lands-on-nsa-watch-list
mef 8y ago
related: 1Password Travel Mode https://support.1password.com/travel-mode/ https://support.1password.com/travel-mode/
BLKNSLVR 7y ago
My assumption is that this will become "the norm" for anyone that frequently travels across borders and deals with sensitive information. As another commenter mentioned above, in the age of the internet and almost ubiquitous connectedness to it, what need is there to transport files on a device that can be seized and searched? It's purely a limitation of the technical knowledge to make it easy to access data remotely. Package it up and sell it and you've got yourself a tidy little niche. Just watch out for governments asking for (or trying to create) backdoors. When I traveled overseas I factory reset my phone and just used a dummy gmail address on it, then put my normal account back on once properly in the country. It's a matter of managing the details required to "get everything back" with minimal time and hassle. I'm a boring person unlikely to get onto any lists, other than the fact I like the intellectual challenge of maintaining a level of privacy slightly above what the 'state' might want me to have. Too many people doing this, however, would cause a surveillance step-up to spot checking tourists / visitors mid-visit. That'll be an interesting law to try and pass.

vba 8y ago

Do you actually have to tell the officer’s your password or do you need to just unlock the device. Also, are you allowed to be there while they are searching it to see what they’re looking at/searching for?

karmakaze 8y ago

I think there could be a market for backup/wipe/restore services. Very feasible for phones leave minimally needed contact info during travel. For laptops keep the is on device and user data on external pulled and put in checked luggage. Security's annoying but lazy. Edit: removable storage on mobile could get popular as a privacy feature.

paulkon 7y ago
I imagine an service which makes an image of your system and launches it as a remote VM that you can access or store to an encrypted external disk. If your encrypted disk gets through then you can restore your data or boot from it. If not then you can remote into your machine in the cloud or download the image if you have access to a fast connection at your destination.

xparco 8y ago

Good. If he has nothing to hide, he should have given the passwords.

hestefisk 8y ago

It’s even worse in Australia: https://www.theguardian.com/world/2018/aug/25/sydney-airport-seizure-of-phone-and-laptop-alarming-say-privacy-groups https://www.theguardian.com/world/2018/aug/25/sydney-airport...

jrandm 8y ago

Why doesn't everyone simply refuse to share passwords, as is mentioned numerous times on various Canadian government websites? Basic search finds tons of pages from all sorts of departments https://www.canada.ca/en/sr/srb.html?q=share+password https://www.canada.ca/en/sr/srb.html?q=share+password A few samples > 95% [of polled Candians] know not to share their passwords https://www.getcybersafe.gc.ca/cnt/rsrcs/vds/nln-sft-stck-p/index-en.aspx https://www.getcybersafe.gc.ca/cnt/rsrcs/vds/nln-sft-stck-p/... > don’t share your PIN, password or personal security questions and answers with anyone, not even family members https://www.canada.ca/en/financial-consumer-agency/services/banking/online-banking.html https://www.canada.ca/en/financial-consumer-agency/services/... > If you’ve shared passwords with friends, now would be a good time to change them https://www.getcybersafe.gc.ca/cnt/blg/pst-20180913-en.aspx https://www.getcybersafe.gc.ca/cnt/blg/pst-20180913-en.aspx > Protect your password, don’t write it down or share it with anyone and change it often https://www.canada.ca/en/employment-social-development/programs/homelessness/hifis/training/administrative/module-1/thinking-security.html https://www.canada.ca/en/employment-social-development/progr... A few days of every single traveler saying "no" would force them to either begin seizing all electronic devices or to drop the entire endeavor as untenable. This problem doesn't need a technical solution beyond making sure locked devices are actually secure.

jason0597 8y ago
Because border police have authority
- jrandm 7y ago
  Could you elaborate on that thought? Individuals also have the authority to assert their rights, one of which in Canada is the freedom from unreasonable search and seizure[0]. R v Fearon[1] places limitations on this exact type of search one could easily argue aren't met given the descriptions of these searches I've read. [0] https://en.wikipedia.org/wiki/Section_8_of_the_Canadian_Charter_of_Rights_and_Freedoms https://en.wikipedia.org/wiki/Section_8_of_the_Canadian_Char... [1] https://en.wikipedia.org/wiki/R_v_Fearon https://en.wikipedia.org/wiki/R_v_Fearon

JustSomeNobody 8y ago

I remember signing documents that said I (basically) would not allow anyone access to my work phone or laptop. This would put me in quite a pickle if work council wasn’t immediately available I would think. Glad I don’t travel for work outside the US.

yaiu 8y ago

Just set a duress password https://github.com/rafket/pam_duress https://github.com/rafket/pam_duress https://github.com/jcs/login_duress https://github.com/jcs/login_duress

deleted 8y ago
[deleted]
justadudeama 8y ago
Pretty sure this can count as lying to / misleading a boarder agent.
- ultrarunner 8y ago
  Is "now, listen, you knew what we meant" a valid response, though?

jijji 7y ago

carry two phones, one used only when traveling across the border. Swap sim cards when needed.

idlewords 7y ago

Since he's a lawyer, there is a 99% chance his password is 'password123', and that it is written on a legal pad in his laptop bag.

imroot 7y ago

I really can't be the only person who travels internationally with a burner phone and burner laptop. I'll generally wipe them both sitting at the airport waiting for my flight home, just so that I can have the e-passport application up by the time that I land and go through customs. (Admittedly, I should just upgrade my TSA Precheck to Global Entry, but, I'm not even sure that I want to go through with that process).

tiglionabbit 7y ago
When I was working at Google I had to go through some training videos that explained that you should never bring corporate devices across the border for this very reason -- that they could be searched, thus breaking the NDA. They'll ship you a clean laptop instead.

x0054 7y ago

Next project: figure out how to add a fake user to my MacBook and only have the real HD / user boot if a key combo is placed. Apple should add users and this as an option if they care about security, to iOS.

tiglionabbit 7y ago
They should show just one account, but give it two passwords: a real one, and one that secretly takes you to a different account that's also customizable.

ivl 7y ago

Personal computers (and cell phones) contain more information than people could have ever imagined when polices around searches at borders became a thing. It's really unfortunate that there's no desire to respect that. You could find more from someones smartphone than you could via a search of their home with a warrant. I'm pretty glad I travel a lot and can afford a second phone as a total burner that I keep nothing on, and a new m.2 SSD and a clean install for my laptop. It's saved so much hassle, as the one time I was asked to look at them, it was an easy "Sure officer, go right ahead. I hope you're quick though, there's nothing on either."

emptybits 7y ago

If you demonstrate that government employees changed files all over your hard drive during a "search" then I wonder if recourse or compensation or legal action is possible. I understand the law permits CBSA agents to perform warrantless searches. e.g. reading the contents of your hard drive. This is, rightly, controversial. But then does the law also permit them to modify the contents of your hard drive? The act of logging in and browsing your computer will make many changes to system log files, to metadata of documents (e.g. last accessed date), etc. (Just thinking out loud about technicalities and other angles on this.)

p2t2p 8y ago

On Linux, one could use dm-crypt in plain mode with keys on number of flash drives. Good thing about keys, they look like unformatted disks, so you can send flash drives via mail in advanced. Whenever you open a laptop like this without a key inserted, it look like it has no bootloader, no OS. There is no metadata, no nothing. Get ready to have your devices seized though =).

wolco 8y ago

This is one problem asking for a sass solution. What services exist to help this situation?

paulkon 7y ago
if a solution were to be created, could the company be held liable for obstruction of justice via aiding and abetting? I guess this could be taken care of with an extended terms of service which lay out how the product shouldn't be used to prevent search and seizure by government officials...
- wolco 7y ago
  Not if it is marketed as an online desktop or backup.

dijital 8y ago

Just enable guest mode. Pretty sure they're not employing top notch cyber investigators for security searches. They aren't smart enough to know the difference and it'll meet their "requirements". Fucking assholes

craftinator 8y ago

I'm planning a trip overseas sometime in the future, and I'm sorely tempted to write up some malware that will activate if someone attempts to download my hard drive in the wrong way. I'll provide the password, along with a statement that I'm not authorizing a search of the drive, and if they want to break the law they are doing so at their own expense. Any lawyers know if I would still be liable for the outcome?

Havoc 7y ago

I guess America no longer has a monopoly on that unique brand of freedom.

connorcodes 7y ago

He did the right thing... Even if it was illegal.

antpls 7y ago

I don't know the past of that lawyer, I don't know if that story is true or not, but it worries me even if I am 6000km away.

helsinki 7y ago

Something similar happened to me. One of the most uncomfortable moments of my life.

stevespang 7y ago

Almost all data can be store nowadays on a microSim, something so small it could be tucked away in a tiny place customs has no clue. Backup by using an encrypted online backup service with a VPN

ElCapitanMarkla 7y ago

Something I wish iOS had is the dummy password to unlock the phone into a sandboxes type area without any of my personal data. “Yeah sure i’ll unlock it, nope that’s all I have on there”

Macross8299 7y ago
I think this might backfire, though. It's the same problem with Veracrypt/LUKS hidden volumes. If they know about the sandbox capability, they could easily say "okay, now unlock the real one" if they find nothing incriminating. What happens if you _did_ unlock the real volume/sandbox in the first place and have nothing incriminating on it? Only remedy for this is having arbitrarily many sandboxes.
- lalos 7y ago
  You could get away with it if you could download sandboxes from iCloud and be allowed to have multiple sandboxes.

notyourday 7y ago

> He said the officer then confiscated his phone and laptop, and told him the items would be sent to a government lab which would try to crack his passwords and search his files. I'm breathlessly waiting for the "We will not go to Canada! Move the conferences out of Canada!" posts.

kenneth 7y ago

I think the best solution to that is to have a "honeypot" account, at least on your laptop. Have a random account with some photos / random documents that you login to by username. Hide the main account's home folder and hope the authorities aren't savvy enough to look properly. They probably aren't. Perhaps add something to its login files that'll automatically wipe the main account data.

golemiprague 7y ago

The right to search luggage is in order to find contraband or bombs. The only reason to dig into a phone in the context of border patrol is to find information on someone, like if they want to work illegally. In that case the person should have the right to not show it and they have the right to turn them back to where they came from, but not to confiscate their phones.

Benjamin_Dobell 7y ago

It's stuff like this that makes me want to build after-market privacy-oriented Samsung firmware, that at a low level (secondary bootloader) supports dual booting. By default you'd boot into the "non-private" environment. That way if customs asks to see your device, you simply boot it up and hand it over. Could make life a lot easier for lawyers, doctors, C-level executives etc. I should note, dual-booting Android phones isn't a new concept, it's just generally performed at a higher (less secure) level. In particular, the secondary bootloader implements Loke (flashing protocol)[1], so a custom secondary bootloader could also prohibit flashing of unsigned images. [1] source, I'm the developer of Heimdall - https://github.com/Benjamin-Dobell/Heimdall https://github.com/Benjamin-Dobell/Heimdall - https://gitlab.com/BenjaminDobell/Heimdall https://gitlab.com/BenjaminDobell/Heimdall

baroffoos 7y ago
Thanks for your work on Heimdall btw. It the only reason my samsung s5 is still running fine years after it came out.
- andai 7y ago
  Did you put a new Android on it, or just a bloat-free ROM? My devices became noticably slower with (official) major Android version upgrades.
  - baroffoos 7y ago
    The latest lineageOS roms. They seem to work well.
numakerg 7y ago
Would this system come with plausible deniability? Also, does anything like this exist for desktop operating systems?
- bitcoinmoney 7y ago
  Yeah. You can install GRUB snd default load it to windows 10 fresh install. Put some dummy files in the desktop, make it cluttered with oictures of cats and articles about meditation. This might sound like a great idea maybe i should try it!!

adad95 7y ago

https://borderprivacy.ca/ https://borderprivacy.ca/ Its a site trying to campaign about this issue.

ada1981 7y ago

I’d love to have a second password that when I enter it automatically encrypts the phone and simultaneously loads a dummy user account. This way I can give them my password, let them look around at some basic programs, benign emails, photos, etc. and then hand me back the phone. Perhaps even a couple dummy passwors so I can keep a password like “1111” to generate a false positive if they try to brute force my phone. I’m surprised this doesn’t exist a jailbreak feature. If it does, please let me know as I’ve looked.

iwalton3 7y ago
The problem is if these features become common enough you will start getting asked about them. Even worse, if you aren't using them you may be asked to provide something that is impossible to provide.
- ada1981 7y ago
  So the answer I suppose is as stated. Cloud backups and when traveling, clearing our devices.

Amygaz 7y ago

Considering he is a lawyer and a politician and civil liberties activist, he knew CBPA’s rights very well, and this is a public stunt to encourage the government to change the law. A simple search about this nick wright, reveals that this is not his first encounter with the authority. He is definitely more active about civil liberties than the average person. He has been arrested during a G20 event, and his story then sounds a bit like this one. So, we either have case of lightning striking the same person twice, or he likes to play games with the law.

mrunkel 7y ago
> So, we either have case of lightning striking the same person twice, or he likes to play games with the law. Or he's being targeted now because of his past activism.

sonnyblarney 7y ago

"During 38 per cent of those searches, officers uncovered evidence of a customs-related offence — which can include possessing prohibited material or undeclared goods, and money laundering, said the agency." If this is true ... wow.

drivebycomment 7y ago

Get a Chromebook, factory reset before going through security, go through the security, then login. Same for the phone for android. Nowadays both Chromebook and Android recover almost all states back fairly quickly and smoothly that you can do this with minimal hassle. i.e. There's no password to share if the devices are fresh.

deleted 7y ago

[deleted]

rjf72 7y ago

Exactly how many meaningful crimes have been prevented or busted because of this behavior? I think sacrificing liberty for security is generally a bad idea. But it seems we're increasingly sacrificing liberty for nothing, which is a rather worse idea. We're creating a dystopia for what? To get people to click on ads on one front, and on fronts like this - the pretext is mostly to stop terrorism, but that's something that should be cleanly quantifiable. So let's quantify it. How many terrorist attacks has this stopped? I think the safe ballpark is exactly 0. I also don't understand why more people don't seem to ask this question. Can governments do this is going to be an extremely difficult to answer question that few of us lack the expertise to even begin to delve into. Even for those of us with it, there are contradictory views. It seems much easier to answer should governments do this. And if they're driving a meaningful deterioration of society, as I would call the stripping of basic rights of individual privacy, and have nothing of substance to show for it - then this is something for which there is no ambiguity whatsoever.

hackermailman 7y ago

Same thing happened to me last year, flagged by Canada customs as some kind of potential sex criminal being a solo male traveller and I just gave them my unlocked phone to search through so I could get out of there after a 12hr flight. I had keepassx android 3rd party app installed to keep financial info and passport pics in case my bank cards and other things were stolen, totally forgot it was there and they didn't even ask me for the pw, returning my phone and letting me go. If I was a degenerate criminal I could have had anything in there was surprised they didn't notice it.

coldacid 7y ago

Even for Canada, standard disclaimers apply to any hardware taken by the government: Don't connect them to anything else, bleach them and burn them.

8fingerlouie 7y ago

Cases like these makes me want to take extreme precautions when traveling. I recently returned from a trip to the US, and prior to boarding (in any direction) i wiped my browser history, and logged out of iCloud, wiping all message history etc. When i arrived at my destination i simply restored from the last iCloud backup, and things "magically" reappeared. Reading the comments here made me realize that it's much more than just personal emails/notes, but also things like Uber history, frequent locations, frequent calls, etc. Basically anything you do that has a pattern to it, or matches a list of keywords. As i don't see the need nor justification for any government to profile me in detail, I'm seriously considering doing a complete wipe of the phone for my next trip, setting it up as a basic _phone_ and restore a backup once i arrive. For a laptop i would probably set it up as new, and bring an installation media with me, reinstalling when i arrive.