15 ms·
Court Rules No Suspicion Needed for Laptop Searches at Border
- Natsu 13y agoThere are a lot of courts out there, so to save others the trouble, this ruling is from the US District Court of the Eastern District of New York.
- neoyagami 13y agoSo it wont apply if im going to other places of eeuu?
- Natsu 13y agoIt's more a matter of how high up the decision was made--as far as I know, they're doing hunch-based searches at all borders (or close enough to make it seem that way). This is only the first step of the inevitable appeals. If memory serves, and it has been a long time since I studied court procedure, the next step is the district court of appeals, then perhaps an en banc review, then the Supreme Court. I'm going on memory here, though, so corrections/clarification from actual lawyers would be welcome.
- dobbsbob 13y agoOr phones, the first thing customs does here is demand your phone and then start going through emails while you are waiting in front of them. If you have Mobiflauge installed this is no problem. Let them snoop the decoy all they want and then load up your hidden evil android install when you pass through
- Crito 13y agoSo what options do I have without rooting my phone? Would it be worth stashing my phone in my underwear in my luggage in my trunk, then handing them a dumb old flip phone when they ask for my phone? They probably won't search all of my stuff and find the other phone, right? I don't have anything on my phone that would get myself or others arrested, but I nevertheless want privacy. Would it be best to just give up on bringing a phone with access to any of my real data across the border?
- ps4fanboy 13y agoThis. The first time I traveled to USA I was super nervous about customs going through all my emails, not because I have anything to hide but I want privacy. From what I have seen/heard/read TSA is pretty much a minimum wage job and they arent the pinnacle of professionalism. It is only a matter of time before this kind of mass searching is used to blackmail and extort people.
- saryant 13y agoPoint of clarification: TSA is not involved in border searches, that's the realm of Customs and Border Patrol. CBP and TSA both fall under DHS but they are not the same agency and there are some very important differences. TSA aren't law enforcement for one.
- ericcumbee 13y agoNot yet, but DHS has been pushing to make TSA agents have the same broad authority that Federal agents like FBI and CBP have.
- kalleboo 13y agoWhere is "here", if I may ask?
- chimeracoder 13y agoThis report is unclear: did they ask Abidor for the password to his laptop (if it was password-protected)? IANAL, but it makes me wonder if it is sufficient protection to have a password protected/encrypted device.
- travisp 13y agoI believe being forced to hand over your passwords is still a murky gray area. But, even if it "protects" you, there's probably a chance that you may not get your device back for a long time.
- rdl 13y agoAlso, if you get your device back, especially if you had encrypted data on it, please don't just naively keep using the device. (You may be able to sell it to a security researcher!)
- bazzargh 13y agoYes, they did (and he gave it). They even asked him to write it on the computer so that they could continue to use the password when they took the laptop from him.
- thematt 13y agoDoes anybody know what they're looking for? Border Patrol/TSA/Homeland Security agents aren't the sharpest tools in the shed and I can't imagine they're very computer literate. Are they just poking around the filesystem? Do they have automated tools that search for stuff?
- chimeracoder 13y agoThey're looking for a file on your desktop named "location_of_smuggled_drugs.txt". In all seriousness, I don't think there's anything in particular they're looking for. They're just looking for anything that gives them suspicion, which gives them an excuse to question and investigate you further.
- Crito 13y agoDoes anybody know how they tend to react when they are greeted by nothing but a getty on a tty? Should I install GNOME to make border guards feel comfortable? I haven't crossed the border in the past decade, but may need to semi-frequently in the near future.
- bonestamp2 13y agoPut a linux live CD in your drive and set that as the priority in the boot sequence.
- ChuckMcM 13y agoOne of the nice things about my Lenovo T430 is that it has both an SSD and a hard drive. You can pop into the BIOS and set the boot order so if you want the 'windows xx' thing to boot for the security theatre you can set it that way when you travel. Still it is outrageous that a court feels this is not a violation of your 4th, 5th, and 14th amendment rights.
- gizmo686 13y agoYou don't need multiple hard drives to do this. If you have a configurable boot loader (such as grub), you can specify what you want to boot into and skip the menu entirely.
- rdl 13y agoBest current practice for crossing "hostile" borders remains wiping all data off the devices, traveling with them in close to factory state, then bringing them back to your baseline once inside the country. It's a little tricky and a bit of a pain, especially if you have a lot of stuff you want to download (for me, I usually work with VM images, so I need to download many many gigabytes, and hotels often have bad Internet). It also makes "getting any work done on the plane" a real pain. (There's also the "travel loaner laptop pool" concept, and the restricted access for remote people. Works a lot better for an organization than for individuals; this would be kind of an interesting appliance or service for individual professionals and for SMBs.)
- salient 13y agoBy the way, I hear you can't really "wipe" data on SSD drives. I don't remember why exactly though. Probably some fault-tolerant mechanism. Or maybe it's what NSA has been asking HDD OEMs to make from the beginning.
- thirsteh 13y agoMost new SSD drives, e.g. Samsung's or Intel's, have transparent encryption (no matter if you set it up or not,) and you are able to "format" your drive by wiping the container with the encryption key, effectively making all data on the drive appear as random noise as long as the encryption algorithm, e.g. AES-256, isn't broken.
- raverbashing 13y agoHummm not really Just write data up to its size. Multiple times, just to be sure Read it from /dev/urandom
- rdl 13y agoUnfortunately this isn't adequate. Drives contain "extra" storage space above rated capacity, as well as reduce delivered capacity, which gets periodically unmapped by wear leveling, or due to errors, etc. This is a bigger deal on SSD than on spinning-rust, but even with rust, it was an issue (esp with 4K sectors, or when worried about things like keys). It's certainly better than nothing, but not sufficient practice in a business or high-security-professional environment. An attacker is willing to load custom firmware onto the drive, or to move the chips into a new device, or otherwise read it out raw, and will have access to more material than your dd can write. The standard should be "can I prove this will work reliably, given all the layers beneath me", and for that, the only adequate answer is physical destruction. You could possibly design a drive where you're guaranteed to know if everything is fully deleted, and as long as you trusted the design/implementation/current-status, you could rely on it, but then you'd have a $100k 100GB SSD. So much easier just to replace old drives, or to guarantee that nothing interesting every touched the disk unencrypted, or ideally both.
- GigabyteCoin 13y agoHere's an idea. Leave everything up and running on a desktop safely inside your own home and connected to the internet 24/7. Bring your own barebones laptop with nothing installed on it to COUNTRY_PARANOID_OF_EVERYTHING. Using X11 forwarding, one must only remember the password to their home desktop in order to gain full access to it and all of it's graphical programs. https://wiki.archlinux.org/index.php/Secure_Shell#X11_forwarding https://wiki.archlinux.org/index.php/Secure_Shell#X11_forwar...
- znowi 13y agoHere's another novel idea. How about to fucking riot and repel this policy? So far, the reaction on intrusion of privacy by the government from the people was to circumvent it, go underground. A reaction commonly expected from a country like Soviet Union where people had zero say on the rulings and had to be creative to avoid surveillance. I'm saddened to see a similar attitude in the US.
- deleted 13y ago[deleted]
- philwelch 13y agoWe tried electing a civil libertarian constitution scholar for President. What exactly are we supposed to try next?
- haswell 13y agoI think the only answer is to keep trying. I think there will come a point where even the non-technical masses will understand just how backwards everything has become. And upon this growing understanding a future libertarian / constitution scholar will run, and run successfully.
- deleted 13y ago[deleted]
- mindslight 13y agolol. Quoting GP: > riot ~50% of people have already determined that voting isn't worth their time - wise up and get with the program. The jury box has been thoroughly pwned as well. Traditionally, the remaining step is the ammo box. But that lacks popular support because people are well fed, so we might as well try to turn things around this new fangled computational b0x before that stops being the case.
- plg 13y agoHow does this work with Chromebooks? For example if I disable all local storage? What is the distinction between what's "on my device" and what's not, if the simple act of "logging into my device" actually involves connecting to the cloud and automatically accessing stuff?
- gress 13y agoJust pray your chromebook doesn't have a cellular modem.
- rcthompson 13y agoOr remove the SIM card before crossing the border. And maybe if you're rooted, make a nandroid backup and then install a completely stock, uncustomized Cyanogenmod that isn't connected to your accounts and doesn't have any wireless settings installed. Just install Angry Birds and tell them that's what you use it for.
- DanBC 13y agoLying to border agents is probably a bad idea. Even when they're doing evil stupid things like this.
- rcthompson 13y agoWell, you can just tell them that it's not connected to your email, which would be the truth.
- plg 13y agoI guess what I mean is, does the government have the right to demand that I log into internet accounts, and let them browse the info, if I'm within 100 miles from the border? Or do they only have the right to access information that's physically located on the physical devices on my person?
- ffrryuu 13y agoOur very own banana republic
- deleted 13y ago[deleted]
- zacinbusiness 13y agoHere's a question. Do the TSA people know about Bootcamp? If my laptop boots to OSX automagically, will they even know to control boot into Windows?
- MiWDesktopHack 13y agothey plug their magic box into your firewire port and dump your memory and image your disks. They don't care about what OS you are running. they grab it all.
- kzrdude 13y agoHow do big corporations that take their information security seriously (and have industrial secrets to protect) look upon this? Do they have routines for travel?
- saryant 13y agoAt least one of the major oil firms uses a pool of laptops requisitioned and distributed outside the US. Leave your company laptop + phone at home, fly to your destination outside the US and the local office will provide you with temporary equipment. The company in question doesn't use this policy for all countries, typically just China, Russia and some of the more questionable nations they do business in (Nigeria, Kazakhstan, etc). They don't bother for travel to, say, London.
- aquadrop 13y agoWhat questions do you want to ask those nations?
- Turing_Machine 13y agoAs far as I know, every country reserves the right to thoroughly inspect anything that crosses their border. Are there actually exceptions to this?
- cm127 13y agoIt hinders international business. How can you negotiate with your cards on the table?
- rl3 13y agoInterdicting data at borders seems to me as the height of stupidity, considering said data can flow freely across borders anyways, via the internet. These policies have no legitimate reason to exist, and can perhaps only be explained by a combination of paranoia, ignorance, and incompetence. It would stand to reason that any terrorists or criminals foiled by these methods would tend to be of the exceedingly dumb variety.
- tzs 13y agoNot everyone who goes into illegal endeavors is the criminal mastermind you fancy that you would be if you turned to the dark side. Hell, there are plenty of people dumb enough to video themselves or friends breaking and entering, beating up people and stabbing people, stealing cars, and the like and POST THESE VIDEOS TO YOUTUBE OR ON SOCIAL NETWORKS. People do in fact cross borders with ridiculously incriminating things on their laptops and phones, such as photos of the kiddie sex tourism, email or logs of chats from the person who talked them into carrying drugs, and things like that.
- StavrosK 13y agoClearly, if anything, we should have more random stops and searches, maybe even in the streets. That would catch more of these dumb criminals.
- tzs 13y agoWhy did you post this as a response to my comment? It has nothing to do with any point I was making (namely, correction of factual errors in rl3's comment).
- deleted 13y ago[deleted]
- StavrosK 13y agoHmm, I read it as justification of the policies. If you didn't mean it as that, I retract it.
- no_one_believes 13y agoBasically, our judges and elected leaders don't believe in the Constitution they are supposed to uphold.
- zaroth 13y agoAmazing, this is literally the first paragraph in the ruling: "Since the founding of the republic, the federal government has held broad authority to conduct searches at the border to prevent the entry of dangerous people and goods. In the 21st century, the most dangerous contraband is often contained in laptop computers or other electronic devices, not on paper. This includes terrorist materials and despicable images of child pornography." Judge Korman is quoting Michael Chertoff, Searches Are Legal, Essential, USA Today, July 16, 2008, at A10.
- tekacs 13y agoContraband? Contraband?!?? If one wished to bring digital contraband into the US, why oh tell me why would anyone ever bring it physically over the border on a machine?!? We invented a network of networks that makes this rather easier to securely do quite some years ago. :@ why would anyone think that contraband-based searches make sense here?
- pmiller2 13y agoThree words: people are dumb.
- sigsergv 13y agoOr there is another reason for such activities, and “contraband” is just a disguise.
- a-nom-a-ly 13y agoIncluding those who make and enforce the laws.
- ericd 13y agoI would have thought that this fairly obvious counterpoint would have been brought up by someone somewhere along the line before this decision was released, though.
- 13y ago
- girvo 13y agoThe issues arise with the fact that every countries border is inherently leaky anyway: the internet makes sure of that. So, searching your computer and confiscating your device because you're not a fan of some not-even-a-cop going through your stuff will just push those that they want to catch to transferring files somewhere to retrieve when they're in the country. I'm an Aussie. I have nothing to hide in terms of data on my computer, as far as I know. If I was flying to USA (as an example) tomorrow, I'd wipe my laptop and phone clean, put images on my server, and access them via SSH once I'm through the border... Why the hell do I need to do that?
- lostlogin 13y agoGiven the way US allies behave, I'm not sure your data is any more safe at home. New Zealander here. Amusingly, I know of several people here who cc our prime minister every time they send an email, to save him the effort of signing any request to spy on a citizen. His mailbox must be something awful.
- girvo 13y agoYeah I know, five eyes is alive and well, hence why all local stuff I have is encrypted, despite it being annoying to do so. Sad state of affairs.
- belluchan 13y agoBring a chromebook and they can then use Google.com to search its contents.
- StavrosK 13y agoAnd then you get arrested for the illegal stuff that Google finds online.
- ck2 13y agoHere's the hidden worst part about this they don't mention. You think border means at the point you cross into another country. That's not what it means. Government can now do this behavior a HUNDRED miles inland from a border. You could be just driving across town, to or from work, and they can use this border search law because you are a hundred miles from the border. Oh and the border also includes the ocean, doesn't have to be another country. https://d320ze5h7gg57a.cloudfront.net/sites/default/files/webroot/privacy/spying/cfz_map/Image-Map.gif https://d320ze5h7gg57a.cloudfront.net/sites/default/files/we... 100% of NY, NJ, Florida and half of Texas is subject to these searches as their state is blanketed by the hundred mile limit. edited to correct hundred instead of hundreds, bad memory
- rosser 13y agoThe "Constitution-Free Zone" extends 100 miles from the border or coast, not "HUNDREDS". I find it as abhorrent as you do, but there's no need to exaggerate or FUD. https://www.aclu.org/national-security_technology-and-liberty/are-you-living-constitution-free-zone https://www.aclu.org/national-security_technology-and-libert...
- maqr 13y agoI wouldn't be surprised if you're right, but how do you know that's what this means? I would think the ACLU would be all over that and would have at least mentioned it in the press release.
- ck2 13y agoIt means the fake "checkpoints" that already exist in certain states like Texas that are a hundred miles inland, are completely legitimized. There was a guy who was almost beaten to death at one of them for refusing to comply, there is a youtube video somewhere of it. News like this is buried just like all the gun deaths every week in Chicago, it never makes national news for some reason I don't quite understand.
- tptacek 13y agoThe only videos I've seen are of people refusing to comply and being waved through. In one of those videos, the driver was asked for proof of citizenship, and spent 4 minutes attempting to demand proof of citizenship from the agent before they finally waved him through. It's pretty great. Also: be careful that we're talking about the same thing. There are CBP searches that protect border integrity and search for contraband, and then there are ICE checkpoints that aim to catch illegal immigrants. In practice, ICE's authority is nothing like CBP's: CBP's is much more potent, and CBP is what this article is talking about.
- joshfraser 13y agoI travel abroad a lot and am pretty sure I'm on a special NSA list at this point or will be soon. Besides all my anti-NSA tweets and emails, I've donated money to support Snowden, Lavabit, ACLU, EFF and Ron Paul. I guess it's time to pick up some cheap laptops that I'm okay losing to the border thieves.
- Theodores 13y agoTo add to the fun... Buy a QIC tape cartridge, as used on workstations and servers in the 1990's. Get a dyslexic child to label it with 'Snowden Docs' in faux Cyrillic and then carry that with you, in the top of your luggage. The tape need not have anything on it, although, should you find a QIC drive, you could go for some ASCII art porn that only reveals itself if you pipe the output of dd into od. Obviously, before writing this to the drive, put some adjustments on the tape head so that a correctly calibrated drive won't read it too well. To make sure they don't accidentally miss the tape, deliberately contaminate it with a substance of interest. A bag of fertiliser should suffice. Before you head off on your travels pop the tape in the fertiliser and give it a good rummage so that it gets suitably covered with a fine dust of known-bad-stuff. The outcome of carrying the tape can go one of two ways. Either they give you untold hassle for 'just carrying a QIC tape' (as the headline in Slashdot screams) or they completely ignore the tape, in which case you have 'proven' the way to thwart the TSA is to carry secret documents on a legacy format.
- lostlogin 13y agoIs it breaking any laws to have a few rather infectious viruses on something you know will be searched? Presumably they allow for this though..
- tptacek 13y agoExactly what makes you think that there's a "special NSA list"? There are anti-NSA activists who are routinely harassed at borders, but those people are actually implicated in the leaks themselves. The USG does not give a shit if you donate to ACLU or Ron Paul.
- ericd 13y agoThis is why I have a monthly recurring donation to the ACLU set up - they're constantly pushing back on stuff like this. If this kind of thing sickens you, consider doing the same. As a bonus, I believe it's tax deductible.
- xacaxulu 13y agoThey hate us for our freedoms.
- hrktb 13y agoTo recap, people think search of physical devices is stupid because we now have internet. And (other?) people are also thinking that connecting things to the internet is not a good idea because of NSA/backdoors/security problems. And by the way standard 'just push the button' encryption softwares might have been built in weaknesses. It seems the only way now to keep secret data is : - to be a top expert in security, be able to assess provenly secure software, have a whole chain of them and constantly keep track of what might have been compromised - keep the data in a safe, never fly it, never come near a border, never connect to the internet What would be the next step to make it worse now ?
- bazzargh 13y agoA quote from the ruling that bugs me: "[The detention of David Miranda] is enough to suggest that it would be foolish, if not irresponsible, for plaintiffs to store truly private or confidential information on electronic devices that are carried and used overseas" (p23, https://www.nyed.uscourts.gov/sites/default/files/opinions/10cv4059mo12312013.pdf https://www.nyed.uscourts.gov/sites/default/files/opinions/1...) This is in the middle of a discussion of carrying lawyer-client privileged documents over the border; the judge says you should have no expectation of privacy because other countries may conduct invasive searches too. As advice, it's hard to disagree, that's where we are now; but surely two wrongs don't make a right? It would be obviously wrong for police to confiscate your money because you were walking towards a rough part of town where you might be robbed. Yet that is the kind of logic the judge applies here; he relaxes the responsibilities of the US govt by invoking hypothetical actions by others. The example he cites was not even a normal border shakedown, but a specific action that was signed off by a government minister; do unusual acts like this change expectations of privacy in the normal course of events?
- Roritharr 13y agoWell I know to which country I wont travel with my notebook anymore. As an European Startup we've given up the idea of doing business with the US, it's just too costly and the rest of our business would be affected by risking to expose our European Customers Data to American Goverment Agencies.
- ditojim 13y agoi use a chromebook. problem solved.
- gress 13y agoNope. Problem worsened. Now they can just demand access to your google account.
- ballard 13y agoEncrypt and tamper-protect laptops and smartphones. The news from CCC shows the tip of the iceberg of capabilities including injection-molding hidden radios, JTAG, i2c and hd firmware. I would also desolder and epoxy over any ports that aren't necessary. This year, I would expect to see tools to check for hardware tampering (HIDS for hardware) that can checksum firmware and other non-user data areas. I've forked O-S Tripwire (mostly C++) in case anyone wants to take a crack at it.
- jaynos 13y agoThe worst part is the judges reasoning. From the NY Times article [1]: >In his opinion, Judge Edward R. Korman of the Federal District Court for the Eastern District of New York found that the plaintiffs did not have standing for their lawsuit because such searches occur so rarely that “there is not a substantial risk that their electronic devices will be subject to a search or seizure without reasonable suspicion.” >Even if the plaintiffs did have standing, Judge Korman found that they would lose on the merits of the case, ruling that the government does not need reasonable suspicion to examine or confiscate a traveler’s laptop, cellphone or other device at the border. [1] http://www.nytimes.com/2014/01/01/business/judge-upholds-us-right-to-search-devices-at-border.html http://www.nytimes.com/2014/01/01/business/judge-upholds-us-... edit: I find this reasoning quite similar to the recent ruling in NSA surveillance of "[You wouldn't have known about it without the Snowden leak, so you don't have standing since Congress did not intent for you to know about surveillance]".