8 ms·

Defending Privacy at the U.S. Border: A Guide for Travelers Digital Devices

222 points by llambda 15y ago

_delirium 15y ago
An odd thing about these searches is that they really have no chance of catching anything nefarious carried by anyone halfway intelligent. An acquaintance of mine smuggled digital documentary video out of Iran just by opening up a laptop and loosening one of the two hard drives' connectors so it no longer registered as attached; the brief border search at the airport of course saw one hard drive with nothing particularly nefarious on it, and didn't go to the trouble of determining that this model of laptop should've had two drives. That's not foolproof, but it's going to foil 99%+ of these kinds of casual searches. Of course if someone really suspects you personally and wants to scrutinize your machine in detail, that's another story, but just random dragnet-type searches of machines at borders are laughably easy to foil, with dozens of different methods, so the stopping-terrorism justification doesn't seem plausible.
- slowpoke 15y ago
  That is why we call it "security theater" - because every informed person will realize it's a heap of bullshit that serves no purpose but to get people used to methods of a authoritarian police state. Terrorism is a retarded excuse, period, and anyone who uses it as their primary argument should be laughed out of the building.
  - c1sc0 15y ago
    I commend you for saying this out loud in a public forum. How things have changed in just a few years! Just after 9/11 you would have been laughed out of the building for pulling out the "security theater" card. It warms my heart to see so many people vocally & publicly calling out the bullshit governments are trying to pull on us, no matter if it's SOPA, PIPA, ACTA or whatever they will come up with next. I've been thinking about this internet freedom movement quite a bit lately & I am convinced the single most powerful thing we can do is to come out of our anonymous hiding places & publicly declare our intentions. That's why I created my freedom.txt & hope others will do same: http://fr.anc.is/freedom.txt http://fr.anc.is/freedom.txt
    - mahyarm 15y ago
      I think people in a HN/Reddit/Slashdot type form have been saying this since it was implemented, and everyone was nodding their heads.
  - cafebabe 15y ago
    That is why I believe, that this is more about espionage than security. Even if it happens rarely. Security is just the official excuse.
- sek 15y ago
  The core problem is, laws are not created result orientated. When the people who are targeted, are the ones who avoid being caught, the result will be near zero. We need intelligent accounting here. For example, when the result of this law is: We spent 100 Million to catch 0 terrorists and 20 people for minor felonies. Is it in the public interest to pay 5 Million for catching a person who downloaded an illegal movie? The politicians should be accountable for these things, or they should say in advance "we try this for a month and if it doesn't work or is inefficient we stop it". I also know that statistics are often manipulated, but that is another problem.
  - click170 15y ago
    "The politicians should be accountable for these things, or they should say in advance 'we try this for a month and if it doesn't work or is inefficient we stop it'." I think this goes back to how politicians are deathly afraid of ever, anywhere, being wrong. This seems to even preclude improving/changing their own positions on most things. There is nothing wrong with realizing you were wrong and changing your opinion, rather there is something wrong with hanging onto a belief or opinion when the pile of evidence is not only against you but continues to grow.
- jdietrich 15y ago
  A skilled magician can sneak a raw egg through a full strip-search. What do you imagine a determined attacker could do with a MicroSD card?
  - electromagnetic 15y ago
    Well given the fact I've had SD cards go through washing machines, dryers and even had a DS game get run over by a fully loaded truck and survived. I guess you could literally eat a MicroSD card and deliver it safely and intact in another country. This would even make it better than smuggling something the old way (swallowing a condom) because an air bubble has the chance of showing up in an x-ray. A MicroSD card would likely be completely invisible. Any copper would obviously show up, but the amount is likely to be indistinguishable from the iron we digest and the iron in our blood that is concentrated around our intestinal walls.
    - minikomi 15y ago
      Soon emerging market for edible micro-SD cards?
- derekp7 15y ago
  Another good option is to take a 32-gig SD card, and re-label it as a 1 gig. Then fill the card with random output, reset the number of cylinders in Fdisk to match 1 gig, format a 1 gig partition and fill it with pictures of scenery. Put you encrypted data at some point after 1 gig on the raw device. To anyone looking at it casually, it will appear to be just a 1 gig card. Even if they see the empty space afterwards, with good encryption it should be indistinguishable from random noise. Bonus points for modifying the firmware on the SD card so that it looks like 1 gig at the low level.
  - Estragon 15y ago
    This sounds like a really bad idea, because the forensic tools mentioned in the article almost certainly examine the raw device.
    - kronusaturn 15y ago
      They don't use the forensic tools on everything that passes through, and an SD card full of landscape photos is a lot less likely to arouse suspicion than one full of unreadable encrypted data.
- gst 15y ago
  It's not about the border: http://www.aclu.org/national-security_technology-and-liberty/are-you-living-constitution-free-zone http://www.aclu.org/national-security_technology-and-liberty...
tatsuke95 15y ago
This is ridiculous. Not what EFF is trying do do, but the extent to which people are going to have go to feel secure. Look at the doctor example. Akina the Japanese doctor is going to a wedding out of country. They recommend mailing a laptop to a relative at the wedding, then wiping it there and bringing it back across the border, all to protect the confidentiality of some emails. That is a completely and utterly ridiculous idea. But yet, there it is, seriously stated. 10 years of pacificity towards the erosion of rights and privacy, and here we are.
- guylhem 15y ago
  "That is a completely and utterly ridiculous idea. But yet, there it is, seriously stated" Maybe to you, but not for me. I'm a doctor and a geek. I work on confidential patient data which I manipulate with custom software I write (some C, some perl... even some php at times :-). But every devices this data goes into is encrypted. To avoid any problem, when I travel I take my special "travel laptop" which has a brand new OS install from the night before. I take absolutely no data at all, unless I absolutely need to work on it during the trip - and in this case, this piece of data travels on an external media, in an encrypted form. The macbook and the external media are disposable - should any agent want it, they can have it and keep it. I won't even complain. What I care the most about is preserving the data confidentiality. Why exactly wouldn't you want this kind of protection on your data from your doctor?
  - tatsuke95 15y ago
    Hmm...either I wasn't clear enough, or you misunderstood. Maybe replace "idea" with "concept" or "requirement". What the doctor is doing/should do isn't ridiculous. It's the fact that the EFF had to write a 30 page document that instructs people on how to protect themselves from some neanderthal on a power trip who decides to comb through personal emails at the border. All in the name of fighting piracy. That's ridiculous.
    - guylhem 15y ago
      I see you point know. I'd rather say it's a sad situation, but you play the cards you're dealt.
mrdingle 15y ago
Important takeaways: - Use full-disk encryption. - Secure it with a very long hard to guess password. - Turn your computer off at least 10 minutes before going through customs. - You don't legally have to tell anyone the password with out a court order. - You don't have to give them any information to aid in their search. - Secure delete everything before you travel. Super important: - DO NOT LIE. - You can simply not answer a question. But never lie. - Say, "I'm sorry, but I cannot answer that question." Super super important: - Plan!!! - Decide what you will do *before* you get to customs. - Don't stress out, just relax and don't answer questions you don't want to.
- nekojima 15y ago
  If you are asked if you have "pirated" material on your laptop or various external media devices, and you do, how to respond? "Not to my knowledge." or "I'm sorry, but I cannot answer that question."? Which would then likely raise the alarm in the interrogator.
  - orofino 15y ago
    IANAL. You have 5th amendment rights against self incrimination. You don't have to answer. How do you word that? No idea, but that would be the route to take I think.
    - nekojima 15y ago
      "You have 5th amendment rights against self incrimination." My concern is while that is often stated, those people aren't sitting in the detention centre with you for hours while your digital devices and the material on them is being searched and you are being 'threatened' with further detention, likely bogus charges and pressured to admit guilt for using your laptop as a normal user does.
      - mrdingle 15y ago
        These are standard interrogation tactics that people need to be prepared for. If you really feel threatened, speak to a qualified layer before you make any decisions, say anything, or agree to anything you don't want to. Standing up for your rights and privacy isn't always going to be easy. But sitting in detention for a little while is really a small price to pay for your liberty. Plus, you'll waste a lot of public money in the process.
daintynews 15y ago
My concern with this US border search is the idea of confidentiality. One, we've all seen movies. Lots of them. And though we may laugh at how easily the antagonist acquired the needed information from the protagonist, it can't be said that it can not happen in real life. And this US border search is making that highly possible. Also, for doctors and lawyers, this confidentiality thing I'd like to believe, is sacred. So when another person sees that on their laptops or gadgets, would it be the same as doing a breach of contract or doing something against their oath?
- kijin 15y ago
  I wonder if it would be possible to get the American Medical Association (and whatever the lawyers' equivalent is) to fight against this ridiculous policy. Or would they just shrug and say that doctors shouldn't put confidential data on portable computers?
fl3tch 15y ago
Supposedly, if your hard drive is encrypted, customs agents can hold your computer indefinitely if you refuse to provide the password. The irony is that gigabytes of encrypted data cross national borders every second -- over the internet. So dump your important data in an encrypted file and put it on a file sharing web site, or a VPS, or whatever, and download it again when you get across the border. Nobody with "interesting" data (and half a brain) will be physically bringing it across a border. The searches are useless.
- mrdingle 15y ago
  Nobody with "interesting" data (and half a brain) will be physically bringing it across a border. What's super ironic about this legislation is that it makes local law enforcement's job of actually catching criminals harder. No one's going to get caught at the border with anything but parakeets shoved down their pants. And now criminals are forced to use full-disk encryption and secure delete for everything if they want to travel which will likely lead to more security at home and more obstacles for local law enforcement.
- driverdan 15y ago
  Unless you're traveling to or from a location that won't have a connection or won't have enough bandwidth to support your needs. See the example in the article about the film maker.
spodek 15y ago
Every now and then you have to step back and look at your world. When I was young, people having to take precautions like this were clicheed signs in a movie of someone oppressed by a totalitarian regime. Invariably the "good guys" were working to free people from it. Can we reverse this trend?
mike-cardwell 15y ago
If I had to fly to America these days, I would not take my laptop unless absolutely necessary. I would also do a fresh install of Cyanogenmod on my phone and configure it up only after crossing the border. There was a time that I wanted to live and work in America. These days, I don't even want to visit for a holiday.
fijal 15y ago
This website is horrible to read, occupies about 12% of my screen and does not even support turning pages using keys! EFF, you can do better than that.
- rajbot 15y ago
  There is a full screen button you can click. Here is a direct link to the full screen version, and arrow keys work for turning pages: https://www.eff.org/file/33930#page/1/mode/2up https://www.eff.org/file/33930#page/1/mode/2up Direct link to pdf: https://www.eff.org/sites/default/files/filenode/EFF-border-search_0.pdf https://www.eff.org/sites/default/files/filenode/EFF-border-...
gst 15y ago
I only travel with encrypted data - both my laptop (linux with luks) and my phone (galaxy nexus) use full disk encryption. Currently it seems that the worst that typically happens is that they take your hardware away from you. I don't care too much about that as all my data is securely backed up in the cloud (tarsnap). The value of the hardware is maybe something like 1000 euros alltogether. Given how unlikely it (currently) is that this happens this is an acceptable monetary loss for me. The only thing that bothers with my setup is that encryption in Android 4 is absolutely braindead, as it forces you to use the same password for the encryption as for the screenlock, although the security requirements are completely different: You want to use a really strong password for the encryption, but for the screenlock a short password is sufficient. Hopefully that will be possible in either one of the next versions, or one of the inofficial forks.
chakalakasp 15y ago
This happens in Canada, too. There was a thread on a popular storm chasing forum in 2007 in which a chaser driving from Florida to Canada was stopped by the Canadian border patrol and had his car randomly searched. The post is also here on the chaser's personal blog: http://sky-chaser.com/america.htm#WINDSOR http://sky-chaser.com/america.htm#WINDSOR . They grabbed his laptop that he was using for GPS mapping, brought it inside, then came back out and told him he was being detained in order to investigate the photos he had on his drive. Apparently they were concerned that some of his Asian nudie pics were of underage models. He was then arrested until some specialist could come in and interview him and review the photos to determine if they were underage. After waiting several hours in a cell, the investigator showed up, asked him a few questions, then released him. "You are good to go. We have insufficient evidence and cannot find anything related to the charges suspected, we are sorry for the inconvenience and I hope this does not prevent you from visiting Canada in the future."

222 points by llambda 15y ago

An odd thing about these searches is that they really have no chance of catching anything nefarious carried by anyone halfway intelligent. An acquaintance of mine smuggled digital documentary video out of Iran just by opening up a laptop and loosening one of the two hard drives' connectors so it no longer registered as attached; the brief border search at the airport of course saw one hard drive with nothing particularly nefarious on it, and didn't go to the trouble of determining that this model of laptop should've had two drives. That's not foolproof, but it's going to foil 99%+ of these kinds of casual searches. Of course if someone really suspects you personally and wants to scrutinize your machine in detail, that's another story, but just random dragnet-type searches of machines at borders are laughably easy to foil, with dozens of different methods, so the stopping-terrorism justification doesn't seem plausible.

slowpoke 15y ago
That is why we call it "security theater" - because every informed person will realize it's a heap of bullshit that serves no purpose but to get people used to methods of a authoritarian police state. Terrorism is a retarded excuse, period, and anyone who uses it as their primary argument should be laughed out of the building.
- c1sc0 15y ago
  I commend you for saying this out loud in a public forum. How things have changed in just a few years! Just after 9/11 you would have been laughed out of the building for pulling out the "security theater" card. It warms my heart to see so many people vocally & publicly calling out the bullshit governments are trying to pull on us, no matter if it's SOPA, PIPA, ACTA or whatever they will come up with next. I've been thinking about this internet freedom movement quite a bit lately & I am convinced the single most powerful thing we can do is to come out of our anonymous hiding places & publicly declare our intentions. That's why I created my freedom.txt & hope others will do same: http://fr.anc.is/freedom.txt http://fr.anc.is/freedom.txt
  - mahyarm 15y ago
    I think people in a HN/Reddit/Slashdot type form have been saying this since it was implemented, and everyone was nodding their heads.
- cafebabe 15y ago
  That is why I believe, that this is more about espionage than security. Even if it happens rarely. Security is just the official excuse.
sek 15y ago
The core problem is, laws are not created result orientated. When the people who are targeted, are the ones who avoid being caught, the result will be near zero. We need intelligent accounting here. For example, when the result of this law is: We spent 100 Million to catch 0 terrorists and 20 people for minor felonies. Is it in the public interest to pay 5 Million for catching a person who downloaded an illegal movie? The politicians should be accountable for these things, or they should say in advance "we try this for a month and if it doesn't work or is inefficient we stop it". I also know that statistics are often manipulated, but that is another problem.
- click170 15y ago
  "The politicians should be accountable for these things, or they should say in advance 'we try this for a month and if it doesn't work or is inefficient we stop it'." I think this goes back to how politicians are deathly afraid of ever, anywhere, being wrong. This seems to even preclude improving/changing their own positions on most things. There is nothing wrong with realizing you were wrong and changing your opinion, rather there is something wrong with hanging onto a belief or opinion when the pile of evidence is not only against you but continues to grow.
jdietrich 15y ago
A skilled magician can sneak a raw egg through a full strip-search. What do you imagine a determined attacker could do with a MicroSD card?
- electromagnetic 15y ago
  Well given the fact I've had SD cards go through washing machines, dryers and even had a DS game get run over by a fully loaded truck and survived. I guess you could literally eat a MicroSD card and deliver it safely and intact in another country. This would even make it better than smuggling something the old way (swallowing a condom) because an air bubble has the chance of showing up in an x-ray. A MicroSD card would likely be completely invisible. Any copper would obviously show up, but the amount is likely to be indistinguishable from the iron we digest and the iron in our blood that is concentrated around our intestinal walls.
  - minikomi 15y ago
    Soon emerging market for edible micro-SD cards?
derekp7 15y ago
Another good option is to take a 32-gig SD card, and re-label it as a 1 gig. Then fill the card with random output, reset the number of cylinders in Fdisk to match 1 gig, format a 1 gig partition and fill it with pictures of scenery. Put you encrypted data at some point after 1 gig on the raw device. To anyone looking at it casually, it will appear to be just a 1 gig card. Even if they see the empty space afterwards, with good encryption it should be indistinguishable from random noise. Bonus points for modifying the firmware on the SD card so that it looks like 1 gig at the low level.
- Estragon 15y ago
  This sounds like a really bad idea, because the forensic tools mentioned in the article almost certainly examine the raw device.
  - kronusaturn 15y ago
    They don't use the forensic tools on everything that passes through, and an SD card full of landscape photos is a lot less likely to arouse suspicion than one full of unreadable encrypted data.
gst 15y ago
It's not about the border: http://www.aclu.org/national-security_technology-and-liberty/are-you-living-constitution-free-zone http://www.aclu.org/national-security_technology-and-liberty...

tatsuke95 15y ago

This is ridiculous. Not what EFF is trying do do, but the extent to which people are going to have go to feel secure. Look at the doctor example. Akina the Japanese doctor is going to a wedding out of country. They recommend mailing a laptop to a relative at the wedding, then wiping it there and bringing it back across the border, all to protect the confidentiality of some emails. That is a completely and utterly ridiculous idea. But yet, there it is, seriously stated. 10 years of pacificity towards the erosion of rights and privacy, and here we are.

guylhem 15y ago
"That is a completely and utterly ridiculous idea. But yet, there it is, seriously stated" Maybe to you, but not for me. I'm a doctor and a geek. I work on confidential patient data which I manipulate with custom software I write (some C, some perl... even some php at times :-). But every devices this data goes into is encrypted. To avoid any problem, when I travel I take my special "travel laptop" which has a brand new OS install from the night before. I take absolutely no data at all, unless I absolutely need to work on it during the trip - and in this case, this piece of data travels on an external media, in an encrypted form. The macbook and the external media are disposable - should any agent want it, they can have it and keep it. I won't even complain. What I care the most about is preserving the data confidentiality. Why exactly wouldn't you want this kind of protection on your data from your doctor?
- tatsuke95 15y ago
  Hmm...either I wasn't clear enough, or you misunderstood. Maybe replace "idea" with "concept" or "requirement". What the doctor is doing/should do isn't ridiculous. It's the fact that the EFF had to write a 30 page document that instructs people on how to protect themselves from some neanderthal on a power trip who decides to comb through personal emails at the border. All in the name of fighting piracy. That's ridiculous.
  - guylhem 15y ago
    I see you point know. I'd rather say it's a sad situation, but you play the cards you're dealt.

mrdingle 15y ago

Important takeaways: - Use full-disk encryption. - Secure it with a very long hard to guess password. - Turn your computer off at least 10 minutes before going through customs. - You don't legally have to tell anyone the password with out a court order. - You don't have to give them any information to aid in their search. - Secure delete everything before you travel. Super important: - DO NOT LIE. - You can simply not answer a question. But never lie. - Say, "I'm sorry, but I cannot answer that question." Super super important: - Plan!!! - Decide what you will do *before* you get to customs. - Don't stress out, just relax and don't answer questions you don't want to.

nekojima 15y ago
If you are asked if you have "pirated" material on your laptop or various external media devices, and you do, how to respond? "Not to my knowledge." or "I'm sorry, but I cannot answer that question."? Which would then likely raise the alarm in the interrogator.
- orofino 15y ago
  IANAL. You have 5th amendment rights against self incrimination. You don't have to answer. How do you word that? No idea, but that would be the route to take I think.
  - nekojima 15y ago
    "You have 5th amendment rights against self incrimination." My concern is while that is often stated, those people aren't sitting in the detention centre with you for hours while your digital devices and the material on them is being searched and you are being 'threatened' with further detention, likely bogus charges and pressured to admit guilt for using your laptop as a normal user does.
    - mrdingle 15y ago
      These are standard interrogation tactics that people need to be prepared for. If you really feel threatened, speak to a qualified layer before you make any decisions, say anything, or agree to anything you don't want to. Standing up for your rights and privacy isn't always going to be easy. But sitting in detention for a little while is really a small price to pay for your liberty. Plus, you'll waste a lot of public money in the process.

daintynews 15y ago

My concern with this US border search is the idea of confidentiality. One, we've all seen movies. Lots of them. And though we may laugh at how easily the antagonist acquired the needed information from the protagonist, it can't be said that it can not happen in real life. And this US border search is making that highly possible. Also, for doctors and lawyers, this confidentiality thing I'd like to believe, is sacred. So when another person sees that on their laptops or gadgets, would it be the same as doing a breach of contract or doing something against their oath?

kijin 15y ago
I wonder if it would be possible to get the American Medical Association (and whatever the lawyers' equivalent is) to fight against this ridiculous policy. Or would they just shrug and say that doctors shouldn't put confidential data on portable computers?

fl3tch 15y ago

Supposedly, if your hard drive is encrypted, customs agents can hold your computer indefinitely if you refuse to provide the password. The irony is that gigabytes of encrypted data cross national borders every second -- over the internet. So dump your important data in an encrypted file and put it on a file sharing web site, or a VPS, or whatever, and download it again when you get across the border. Nobody with "interesting" data (and half a brain) will be physically bringing it across a border. The searches are useless.

mrdingle 15y ago
Nobody with "interesting" data (and half a brain) will be physically bringing it across a border. What's super ironic about this legislation is that it makes local law enforcement's job of actually catching criminals harder. No one's going to get caught at the border with anything but parakeets shoved down their pants. And now criminals are forced to use full-disk encryption and secure delete for everything if they want to travel which will likely lead to more security at home and more obstacles for local law enforcement.
driverdan 15y ago
Unless you're traveling to or from a location that won't have a connection or won't have enough bandwidth to support your needs. See the example in the article about the film maker.

spodek 15y ago

Every now and then you have to step back and look at your world. When I was young, people having to take precautions like this were clicheed signs in a movie of someone oppressed by a totalitarian regime. Invariably the "good guys" were working to free people from it. Can we reverse this trend?

mike-cardwell 15y ago

If I had to fly to America these days, I would not take my laptop unless absolutely necessary. I would also do a fresh install of Cyanogenmod on my phone and configure it up only after crossing the border. There was a time that I wanted to live and work in America. These days, I don't even want to visit for a holiday.

fijal 15y ago

This website is horrible to read, occupies about 12% of my screen and does not even support turning pages using keys! EFF, you can do better than that.

rajbot 15y ago
There is a full screen button you can click. Here is a direct link to the full screen version, and arrow keys work for turning pages: https://www.eff.org/file/33930#page/1/mode/2up https://www.eff.org/file/33930#page/1/mode/2up Direct link to pdf: https://www.eff.org/sites/default/files/filenode/EFF-border-search_0.pdf https://www.eff.org/sites/default/files/filenode/EFF-border-...

gst 15y ago

I only travel with encrypted data - both my laptop (linux with luks) and my phone (galaxy nexus) use full disk encryption. Currently it seems that the worst that typically happens is that they take your hardware away from you. I don't care too much about that as all my data is securely backed up in the cloud (tarsnap). The value of the hardware is maybe something like 1000 euros alltogether. Given how unlikely it (currently) is that this happens this is an acceptable monetary loss for me. The only thing that bothers with my setup is that encryption in Android 4 is absolutely braindead, as it forces you to use the same password for the encryption as for the screenlock, although the security requirements are completely different: You want to use a really strong password for the encryption, but for the screenlock a short password is sufficient. Hopefully that will be possible in either one of the next versions, or one of the inofficial forks.

chakalakasp 15y ago

This happens in Canada, too. There was a thread on a popular storm chasing forum in 2007 in which a chaser driving from Florida to Canada was stopped by the Canadian border patrol and had his car randomly searched. The post is also here on the chaser's personal blog: http://sky-chaser.com/america.htm#WINDSOR http://sky-chaser.com/america.htm#WINDSOR . They grabbed his laptop that he was using for GPS mapping, brought it inside, then came back out and told him he was being detained in order to investigate the photos he had on his drive. Apparently they were concerned that some of his Asian nudie pics were of underage models. He was then arrested until some specialist could come in and interview him and review the photos to determine if they were underage. After waiting several hours in a cell, the investigator showed up, asked him a few questions, then released him. "You are good to go. We have insufficient evidence and cannot find anything related to the charges suspected, we are sorry for the inconvenience and I hope this does not prevent you from visiting Canada in the future."