7 ms·

Documents Shed Light on Border Laptop Searches

147 points by driverdan 13y ago

fry_the_guy 13y ago
I guess you need to make sure all your backups are in order before crossing the border.
- mortov 13y ago
  I guess you need to make sure your devices are wiped or left at home. A backup just means you have your own copy of what just got taken off you at the border for no good lawful reason. Having my own copy would not reassure me of much.
  - willbill 13y ago
    Moxie Marlinespike of WhisperNet has explicitly said that he leaves his devices at home when traveling because of this.
  - lambda 13y ago
    Or make sure that they have full-disk encryption and are cold shutdown when you cross the border. While jurisprudence is still a bit fuzzy on this (it has flipped back and forth on a few appeals in a few separate cases, and never been conclusively decided by the Supreme Court), there have been ruling upholding the fact that you can't be forced to hand over your password due to the fifth amendment, unless the Government can already show that they know via other means that you have incriminating files on there.[1] On the border, you would probably be safe from mandatory disclosure of your password without the border patrol getting a court order, and of course the whole point of this complaint is that the government is using border crossing as an end-run around the courts, being able to do searches that a court wouldn't otherwise approve. So, using full-disk encryption that you trust, on all electronic devices that you carry, and making sure that they are cold shutdown, is probably sufficient. You should of course have a backup as well, as the border patrol may impound your devices while they try to decrypt them. All in all, how much effort we have to do to defend ourselves from our own government is getting ridiculous. I don't know how to convince the American public of this, but we are not only violating the privacy of tons of people, but killing people who choose to drive rather than fly[2] due to the excess hassle that our "security" systems provide. 1: https://en.wikipedia.org/wiki/Key_disclosure_law#United_States https://en.wikipedia.org/wiki/Key_disclosure_law#United_Stat... 2: https://www.schneier.com/blog/archives/2013/09/excess_automobi.html https://www.schneier.com/blog/archives/2013/09/excess_automo...
    - chiph 13y ago
      Even with full-disk encryption, an image will be made of the drive, and the government will keep a copy on the chance that the password will be revealed later. Or the algorithm gets broken/weak enough at some point in the future.
      - toomuchtodo 13y ago
        Silly question. Let's assume you have a device like a Macbook Pro or a Macbook Air, where you can't physically remove the drive without ungluing the device. You hotrod the firmware so only trusted USB devices with a specific encryption key are permitted to connect. How would the drive be imaged?
        lambda 13y ago
        Thunderbolt target disk mode: http://support.apple.com/kb/PH3838 http://support.apple.com/kb/PH3838 Perhaps you could solve this by "hotrodding" the firmware, but it's not particularly obvious how you could do that without risking bricking your laptop.
        toomuchtodo 13y ago
        Perhaps Apple needs to require a password to boot off USB or to access target disk mode.
        Torgo 13y ago
        It's too bad the newer Macbook Pros don't come with ExpressCard slots anymore. I used to boot off a fast SSD expresscard. No disadvantages at all, other than the card ran hot. Remove the internal drive and when you pop out the Expresscard, much lower attack surface.
    - andrewpi 13y ago
      After the past week's NSA revelations, just what full disk encryption system should we be trusting? I think it's fair to assume that any commercial implementation is compromised.
grey-area 13y ago
Is the best strategy here to leave your devices at home and just bring a burner phone on holiday or other travels and no other devices? It's strange as an ordinary citizen who might choose to contribute to someone like Manning's defence fund, or post statements supportive of Snowden online, to have to consider that GCHQ or the Homeland Security might put your name on a list for questioning and confiscation at the border, requiring drastic action like this. Given the abuse of them in many countries including the US and UK (which was inevitable), I can't see any case for these powers of arbitrary detainment and confiscation to be given to the police in any country.
- TheCraiggers 13y ago
  I leave mine behind whenever I travel outside the US, not so much because I am afraid to be on a list (although after reading this article, that fear has risen somewhat) but because I employ encryption on my laptop. If they do search my device for anything illegal, they will inevitably ask for my password, which I don't want to give for philosophical reasons. Then it's pretty much guaranteed that I'll be detained and/or my laptop will be taken. You are right that, as a US citizen, this is a very strange revelation to have when packing for an overseas trip. Personally, this very real possibility opened my eyes on just how far we've fallen.
  - m_ram 13y ago
    "I don't remember my password."
    - jlgreco 13y ago
      That is when they detain/harass him and steal his computer anyway.
      - andrewpi 13y ago
        And probably use the NSA backdoor to peek at the hard drive, right?
    - 13y ago
salmonellaeater 13y ago
EFF guide to defending your privacy at border crossings: https://www.eff.org/wp/defending-privacy-us-border-guide-travelers-carrying-digital-devices https://www.eff.org/wp/defending-privacy-us-border-guide-tra...
calbear81 13y ago
Would this only apply to files that are physically on the hard drive or would this also mean they may have access to connected cloud storage accounts like Dropbox or iCloud?
- mbq 13y ago
  They already have your data on Dropbox and iCloud.
revelation 13y ago
Obviously the officials involved in this case were let go, right? Because who would enter into an official database that they want to abuse border searches to search an attorney for a person in an ongoing case with the government, and for that exact reason?
- jellicle 13y ago
  No one in government considers it to be an abuse. That's the problem.
philip1209 13y ago
Make sure your SSH keys have a password.
- chris_mahan 13y ago
  don't store ssh keys.
  - betterunix 13y ago
    SSH keys need to be stored somewhere if they are to be useful. Perhaps the safest bet is to move the keys to a smartcard, carry that with you while you travel, then destroy the card before re-entering the USA.
    - chris_mahan 13y ago
      I don't store ssh keys. I remember the (long) passwords.
aheilbut 13y ago
They say that there were ~5000 such searches per year, which makes them extremely rare occurrences given the hundreds of millions of people crossing the borders in a year.
- notdrunkatall 13y ago
  Next year, there'll be 7,000, and the year after that, 10,000, etc.
- Todd 13y ago
  Yes, but they are targeting individual US citizens and using the broad authority that has been granted to them "to evade the constitution," as the article states. Ostensibly, this authority was granted in order to protect our borders.
kintamanimatt 13y ago
The fact such an article has to be written at all is highly concerning. What kind of free society are we living in when we have to guard heavily against our devices being confiscated and snooped through just because a border agent feels like it? To my knowledge there's only precedent of this happening in the UK and US, but I wouldn't be surprised if other countries are going to join in on these shenanigans.
Aloisius 13y ago
Anyone know what happens if your laptop is dead when you go through border control? I mean, they probably don't keep laptop chargers for every model around. I've gone through airport security with a dead laptop before at a time when they would occasionally ask people to turn on their laptop. They just waved me through.
drill_sarge 13y ago
I have asked this before but didn't get an answer: Do such "you have to hand out your passwords" laws apply to me if I am just a visitor to such countries and my home country does not have such a law?

147 points by driverdan 13y ago

fry_the_guy 13y ago

I guess you need to make sure all your backups are in order before crossing the border.

mortov 13y ago
I guess you need to make sure your devices are wiped or left at home. A backup just means you have your own copy of what just got taken off you at the border for no good lawful reason. Having my own copy would not reassure me of much.
- willbill 13y ago
  Moxie Marlinespike of WhisperNet has explicitly said that he leaves his devices at home when traveling because of this.
- lambda 13y ago
  Or make sure that they have full-disk encryption and are cold shutdown when you cross the border. While jurisprudence is still a bit fuzzy on this (it has flipped back and forth on a few appeals in a few separate cases, and never been conclusively decided by the Supreme Court), there have been ruling upholding the fact that you can't be forced to hand over your password due to the fifth amendment, unless the Government can already show that they know via other means that you have incriminating files on there.[1] On the border, you would probably be safe from mandatory disclosure of your password without the border patrol getting a court order, and of course the whole point of this complaint is that the government is using border crossing as an end-run around the courts, being able to do searches that a court wouldn't otherwise approve. So, using full-disk encryption that you trust, on all electronic devices that you carry, and making sure that they are cold shutdown, is probably sufficient. You should of course have a backup as well, as the border patrol may impound your devices while they try to decrypt them. All in all, how much effort we have to do to defend ourselves from our own government is getting ridiculous. I don't know how to convince the American public of this, but we are not only violating the privacy of tons of people, but killing people who choose to drive rather than fly[2] due to the excess hassle that our "security" systems provide. 1: https://en.wikipedia.org/wiki/Key_disclosure_law#United_States https://en.wikipedia.org/wiki/Key_disclosure_law#United_Stat... 2: https://www.schneier.com/blog/archives/2013/09/excess_automobi.html https://www.schneier.com/blog/archives/2013/09/excess_automo...
  - chiph 13y ago
    Even with full-disk encryption, an image will be made of the drive, and the government will keep a copy on the chance that the password will be revealed later. Or the algorithm gets broken/weak enough at some point in the future.
    - toomuchtodo 13y ago
      Silly question. Let's assume you have a device like a Macbook Pro or a Macbook Air, where you can't physically remove the drive without ungluing the device. You hotrod the firmware so only trusted USB devices with a specific encryption key are permitted to connect. How would the drive be imaged?
      - lambda 13y ago
        Thunderbolt target disk mode: http://support.apple.com/kb/PH3838 http://support.apple.com/kb/PH3838 Perhaps you could solve this by "hotrodding" the firmware, but it's not particularly obvious how you could do that without risking bricking your laptop.
        toomuchtodo 13y ago
        Perhaps Apple needs to require a password to boot off USB or to access target disk mode.
      - Torgo 13y ago
        It's too bad the newer Macbook Pros don't come with ExpressCard slots anymore. I used to boot off a fast SSD expresscard. No disadvantages at all, other than the card ran hot. Remove the internal drive and when you pop out the Expresscard, much lower attack surface.
  - andrewpi 13y ago
    After the past week's NSA revelations, just what full disk encryption system should we be trusting? I think it's fair to assume that any commercial implementation is compromised.

grey-area 13y ago

Is the best strategy here to leave your devices at home and just bring a burner phone on holiday or other travels and no other devices? It's strange as an ordinary citizen who might choose to contribute to someone like Manning's defence fund, or post statements supportive of Snowden online, to have to consider that GCHQ or the Homeland Security might put your name on a list for questioning and confiscation at the border, requiring drastic action like this. Given the abuse of them in many countries including the US and UK (which was inevitable), I can't see any case for these powers of arbitrary detainment and confiscation to be given to the police in any country.

TheCraiggers 13y ago
I leave mine behind whenever I travel outside the US, not so much because I am afraid to be on a list (although after reading this article, that fear has risen somewhat) but because I employ encryption on my laptop. If they do search my device for anything illegal, they will inevitably ask for my password, which I don't want to give for philosophical reasons. Then it's pretty much guaranteed that I'll be detained and/or my laptop will be taken. You are right that, as a US citizen, this is a very strange revelation to have when packing for an overseas trip. Personally, this very real possibility opened my eyes on just how far we've fallen.
- m_ram 13y ago
  "I don't remember my password."
  - jlgreco 13y ago
    That is when they detain/harass him and steal his computer anyway.
    - andrewpi 13y ago
      And probably use the NSA backdoor to peek at the hard drive, right?
  - 13y ago

salmonellaeater 13y ago

EFF guide to defending your privacy at border crossings: https://www.eff.org/wp/defending-privacy-us-border-guide-travelers-carrying-digital-devices https://www.eff.org/wp/defending-privacy-us-border-guide-tra...

calbear81 13y ago

Would this only apply to files that are physically on the hard drive or would this also mean they may have access to connected cloud storage accounts like Dropbox or iCloud?

mbq 13y ago
They already have your data on Dropbox and iCloud.

revelation 13y ago

Obviously the officials involved in this case were let go, right? Because who would enter into an official database that they want to abuse border searches to search an attorney for a person in an ongoing case with the government, and for that exact reason?

jellicle 13y ago
No one in government considers it to be an abuse. That's the problem.

philip1209 13y ago

Make sure your SSH keys have a password.

chris_mahan 13y ago
don't store ssh keys.
- betterunix 13y ago
  SSH keys need to be stored somewhere if they are to be useful. Perhaps the safest bet is to move the keys to a smartcard, carry that with you while you travel, then destroy the card before re-entering the USA.
  - chris_mahan 13y ago
    I don't store ssh keys. I remember the (long) passwords.

aheilbut 13y ago

They say that there were ~5000 such searches per year, which makes them extremely rare occurrences given the hundreds of millions of people crossing the borders in a year.

notdrunkatall 13y ago
Next year, there'll be 7,000, and the year after that, 10,000, etc.
Todd 13y ago
Yes, but they are targeting individual US citizens and using the broad authority that has been granted to them "to evade the constitution," as the article states. Ostensibly, this authority was granted in order to protect our borders.

kintamanimatt 13y ago

The fact such an article has to be written at all is highly concerning. What kind of free society are we living in when we have to guard heavily against our devices being confiscated and snooped through just because a border agent feels like it? To my knowledge there's only precedent of this happening in the UK and US, but I wouldn't be surprised if other countries are going to join in on these shenanigans.

Aloisius 13y ago

Anyone know what happens if your laptop is dead when you go through border control? I mean, they probably don't keep laptop chargers for every model around. I've gone through airport security with a dead laptop before at a time when they would occasionally ask people to turn on their laptop. They just waved me through.

drill_sarge 13y ago

I have asked this before but didn't get an answer: Do such "you have to hand out your passwords" laws apply to me if I am just a visitor to such countries and my home country does not have such a law?