Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What could happen if you refuse to unlock your phone at the US border?

arstechnica.com

Post reply on HN
Print view View original

361–370 of 494 posts

Re: What could happen if you refuse to unlock your phone at the US border?

#361

Post by zeveb »

graeme wrote: post #309
infinite8s wrote: post #294

Earlier quoted context omitted.

Well, in tptacek's case, I believe he's a US citizen so they can't deny him entry.

Hmm. What would be the best practice for a foreign national?

> What would be the best practice for a foreign national?

Understand that you may be denied entry to any country but your own. It's a fact of life which you cannot do anything about, so you might as well accept it.

What I do is:

- travel with a machine which is not logged into any of my accounts

- if asked, I can honestly say that I do not know any of my social-media passwords (because they are all of the form mZOH05WaxeAWqI79myMxcx or SWwDmDOkyHCVdX8eOiTLXC1U1psffeXfFgNx6PaZZhp); if that's unacceptable to customs in any country, they can send me back home

- if they press, I can honestly say that my computer back home (not the computer I have with me) has my master password file, and that there is no other copy

Re: What could happen if you refuse to unlock your phone at the US border?

#362

Post by white-flame »

danbruc wrote: post #85

How is this not in violation of international law, especially the International Covenant on Civil and Political Rights [1] article 17, which would apply to US citizens as well as non-US citizens? No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation. Maybe even article 9 if the law does not clearly establi…

The US can easily claim it's not "arbitrary" because they've been selected by their systems for complete roto-rooter inspection, and it's not "unlawful" because the US laws could allow it.

Re: What could happen if you refuse to unlock your phone at the US border?

#363

Post by loeg »

PeterisP wrote: post #311
rebuilder wrote: post #267

Earlier quoted context omitted.

So basically, as a non-US citizen, if you don't bring a device that can log into your Facebook account, they might deny you entry? Of course rhey might deny you entry for any reason, and them caring so much about your social media accounts is probably a sign you're on a shitlist somewhere, so maybe it doesn't matter so much. I wonder, though, if you don't have FB etc. accounts, do they believe you?

There's a big factor of subjective evaluation, but it can be quite effective. A large majority of people do have FB accounts, and even care about their FB accounts as illustrated by their worries about providing access to them. For most people they wouldn't bother to look, only a tiny fraction of travelers get their devices checked. And if you really don't have FB etc. accounts, they may believe you - I have little r…

> shows a FB account with your face

Which, amusingly, is a Facebook spammer strategy — clone someone's account, including profile picture. So even if you delete your account, there may be a spammer clone that shows up in CBP's database.

Re: What could happen if you refuse to unlock your phone at the US border?

#364

Post by tptacek »

iak8god wrote: post #276
Steuard wrote: post #255

Earlier quoted context omitted.

I thought so, too. But the advice I've seen, quite strongly, is that you do not want to lie to federal officials about anything, ever. Even if you're just using a hidden volume on principle rather than hiding some terrible wrongdoing, the moment you say "No, I don't have any other hidden files on here" or "There, you have access to all my files now" you've committed a federal crime. If they spot the slightest evidenc…

> the moment you say "No, I don't have any other hidden files on here" or "There, you have access to all my files now" you've committed a federal crime. So then you don't say those things. This covers the much more common (I'd imagine) case where a traveler is asked to turn on his device and enter the password, but possibly not the case where the traveler is being grilled/interrogated on the contents of his device. B…

If you're a US citizen, go ahead and try to outsmart them with TrueCrypt. My guess is most of the time you'll succeed. But if you're an alien --- and, especially, if you're a brown-skinned alien --- don't have TrueCrypt on your laptop.

You can make an encrypted backup of your machine and store it in some innocuous place in the cloud, or have it Fedexed to wherever you're staying. There's just no good reason to play games with TrueCrypt at the border.

Re: What could happen if you refuse to unlock your phone at the US border?

#365

Post by zeveb »

tptacek wrote: post #263
M_Grey wrote: post #102

Earlier quoted context omitted.

Solution: No Facebook (which is a solution to so many other problems too), partition and hide what you don't want browsed by some inept CBP agent, and then play your part in their security theatre. It might even be nice if someone could make some programs that offer false home screens for various devices that only open when a given password is input... your CBP "clean slate". Don't say, "I don't have x,y,z..." accoun…

The words "inept CBP agent" get you in trouble here. If you're a citizen, by all means, play chicken! If not: remember, they have vastly more resources than you do. Money buys a lot of forensics techniques --- in fact, governments are better at computer forensics than software developers. They're the ones doing it all the time, and funding all the research. They don't have to decrypt. They just have to decide you're…

> They just have to decide you're suspicious enough to confiscate equipment and bar you from entry.

That's fine with me. I don't take anything to a foreign country which I'm not willing to lose, and I have no problem turning around & heading back home if the country I wish to visit turns out to have unacceptable rules.

If someday I visit someplace that has an implicit rule, 'all visitors must have Facebook accounts,' then I'll just go back home.

Re: What could happen if you refuse to unlock your phone at the US border?

#366

Post by zeveb »

dave_sullivan wrote: post #186
MichaelGG wrote: post #50

Earlier quoted context omitted.

This isn't to catch terrorism. Though they'll probably get a few idiot "extremists", this will mostly stop people coming in under false pretenses. It's bizarre how people don't think ahead to their border crossing and are willing to admit they are going to live with their SO, or work as a nanny -- while under a tourism visa. It'll be very effective at this. Most people aren't going to establish a plausible social med…

> "Real" spies and terrorists and whatever can obviously afford to setup enough cover. > It's bizarre how people don't think ahead to their border crossing and are willing to admit they are going to live with their SO, or work as a nanny -- while under a tourism visa. So we're not catching "real" spies and terrorists; we're catching nannies trying to get paid under the table; do you think maybe we've got bigger fish…

> So we're not catching "real" spies and terrorists; we're catching nannies trying to get paid under the table; do you think maybe we've got bigger fish to fry? This is a bad precedent, and what are we gaining? Nothing.

A country which controls its borders gains … control of its borders. If it's illegal to enter a country as a tourist in order to live with one's girlfriend, well it's illegal to enter that country as a tourist in order to live with one's girlfriend. That doesn't mean the law is right, or good, or desirable, just that if one enters that country as a tourist in order to live with one's girlfriend, one will be breaking that country's law and is liable to be deported.

Although I tend to favour open borders, myself, I think it's perfectly reasonable for the customs police of any country to turn away people trying to enter that country illegally.

Re: What could happen if you refuse to unlock your phone at the US border?

#368

Post by emodendroket »

jacquesm wrote: post #39
tptacek wrote: post #3

Worth remembering: US citizens can play chicken with CBP and lose nothing more than their computer/phone hardware (perhaps having it returned 6 months later). But non-citizens, possibly including LPRs, cannot: if an alien attempts to cross the border with a device they can't unlock "because they don't have the corresponding 2FA token with them" (as one friend suggested they do), they'll be detained, their devices con…

> The current best practice for border crossings --- really anywhere in the world --- is simply not to carry anything you're unwilling to unlock for Customs. Or, to simply stop traveling to countries that refuse to play nice with the rights of foreigners. The whole idea that this sort of thing is even anywhere near acceptable behavior revolts me.

That doesn't leave very many places to go.

Re: What could happen if you refuse to unlock your phone at the US border?

#369

Post by mahyarm »

sandworm101 wrote: post #238

Ive got a trick. As a lawyer i keep a note on my laptop deacribing how it is encrypted (linux, home dirctories + trucrypt archives for important stuff) and that content is subject to attorney-client privacy rules. Ive been asked to unlock several times. I say "sure thing, but ill need some sort of court order so i dont get sued." Faced with a reasonable person willing to unlock, they have never pushed the matter. For…

Does that only work if your a US citizen? If your not then bye bye visa?

Re: What could happen if you refuse to unlock your phone at the US border?

#370

Post by OJFord »

zeveb wrote: post #356
OJFord wrote: post #293

Earlier quoted context omitted.

Why is this being accepted as even remotely reasonable? What about 'login with Facebook' sites? We here know that we should change our password and logout of existing sessions ASAP after being made to do it, but our non-technical family members may not. "Add TSA as a friend" is borderline reasonable, (pun intended) "give us your password" is not even close. It also damages public awareness of importance of maintainin…

> Why is this being accepted as even remotely reasonable? That it's unreasonable and unacceptable doesn't mean that it's illegal. Despite your and my hopes, not all unreasonable and unacceptable things are illegal. > What about 'login with Facebook' sites? Don't do that then. > We here know that we should change our password and logout of existing sessions ASAP after being made to do it, but our non-technical family…

You're missing my point entirely:

People do 'login with Facebook'; people will (perhaps grudgingly) log in for them/hand over their password.

You won't, I won't, but people will because they're asked to by the uniformed officer, despite how mad it is.

I'm just amazed at the lack of significant opposition to this, there doesn't even really seem to be any opposition. Here on HN where one might expect it to be most opposed, we're merely discussing how to mitigate the effects (you can't, don't go - or be prepared to be turned around).

I wouldn't pay for my own travel to the USA (while I've been before, and enjoyed my trips, etc.) because I'm not an idiot - and handing over a password is idiotic - and I can't really afford a wasted trip. Sure, sunk cost, whatever - the cost/risk isn't worth it, at least for now until it's shown that they rarely do it, and really it's only x,y,z countries from where I do not hail.

Post reply on HN