Protecting Yourself From Suspicionless Searches While Traveling

Posted by Jennifer Granick [on the EFF Deeplinks blog]

The Ninth Circuit’s recent ruling (pdf) in United States v. Arnold allows border patrol agents to search your laptop or other digital device without limitation when you are entering the country. EFF and many civil liberties, travelers’ rights, immigration advocacy and professional organizations are concerned that unfettered laptop searches endanger trade secrets, attorney-client communications, and other private information. These groups have signed a letter asking Congress to hold hearings to find out what protocol, if any, Customs and Border Protection (CBP) follows in searching digital devices and copying, storing and using travelers’ data. The letter also asks Congress to pass legislation protecting travelers’ laptops and smart phones from unlimited government scrutiny.

If privacy at the border is important to you, contact Congress now and ask them to take action!

In the meantime, how can international travelers protect themselves at the U.S. border, short of leaving their laptops and iPhones at home?

Many travelers practice security through obscurity. They simply hope that no border agent will rummage through their private data. Too many people enter the country each day for agents to thoroughly search every device that crosses the border, and there is too much information stored on most devices for agents to find the most revealing and confidential tidbits. But for travelers who may be targeted based on their celebrity, race or other distinguishing factor, obscurity is not an option. As last week’s news that Microsoft is giving away forensic tools that can quickly search an entire hard drive on a USB “thumb drive” shows, it won’t be long before customs agents can efficiently perform a thorough search on every machine. So long as there are no protocols or oversight for these searches, every traveler’s personal information is at risk.

Encryption is one (imperfect) answer.

If you encrypt your hard drive with strong crypto, it will be prohibitively expensive for CBP to access your confidential information. This answer is imperfect for two reasons—one is practical, the other is technological.

Practically, the government has not disclosed CBP’s laptop search practices, despite our Freedom of Information Act lawsuit for these documents. We don’t know what a border patrol agent will do when confronted with an encrypted machine. One possibility is that the agent will simply give up and let the traveler pass with her belongings. Other possibilities are that the agent will turn the traveler and her machine away at the border, or that he will seize the laptop and allow the traveler to continue on. I suspect that on most occasions, CBP agents confronted with encrypted or password-protected data tell the owner to enter the password or get turned away, and the owner, eager to continue her voyage or to return home, simply complies.

If you don’t want to comply, CBP cannot force you to decrypt your data or give over your password. Only a judge can force you to answer questions, and then only if the Fifth Amendment does not apply. While no Fifth Amendment right protects the data on your laptop or phone, one federal court has held that even a judge cannot force you to divulge your password when the act of revealing the password shows that you are the person with access to or control over potentially incriminating files. See In re Boucher, 2007 WL 4246473 (D. Vt. November 29, 2007).

If, however, you don’t respond to CBP’s demands, the agency does have the authority to search, detain, and even prohibit you from entering the county. CBP has more authority to turn non-citizens away than it does to exclude U.S. persons from entering the country, but we don’t know how the agents are allowed to use this authority to execute searches or get access to password protected information. CBP also has the authority to seize your property at the border. Agents cannot seize anything they like (for example, your wedding ring), but we do not know what standards agents are told to follow to determine whether they can and should take your laptop but let you by.

Technologically, encryption is imperfect because even strong crypto can be cracked when someone obtains the keys. Border agents can demand the keys from travelers unwilling to face seizure or detention. Agents may also be able to extract and use keys that are stored on the machine itself. Generally, if you keep your keys with the laptop, in your head or on your disk, then the encryption is easier to socially engineer or break than if you keep the keys elsewhere. (Discussion of what encryption techniques to use or avoid is beyond the scope of this post.)

Encryption aside, there may be other ways you can show CBP that your laptop is indeed a normal computer and that you mean no harm while keeping confidential information from prying eyes. Most operating systems let users to create multiple accounts on a single machine. A traveler could allow CBP to examine his own account, while storing client data or trade secrets in a separate account “owned” by his law firm or corporation. Under typical border search circumstances, this might satisfy CBP concerns. However, simply storing information in a different account—even one protected by a password—is not the same as encrypting it. If CBP is interested, the most commonly used forensic search tools can access and search non-encrypted data in every account on the machine.

Law firms, corporations and other entities that routinely deal with confidential information are handing their business travelers forensically clean laptops loaded with only what the traveler needs for that particular business trip. Leaving unnecessary data, like five years of email, behind may be the best thing. Of course, if trade secrets or client information are the reason for the trip, this plan will not help.

Another option is to bring a clean laptop and get the information you need over the internet once you arrive at your destination, send your work product back, and then delete the data before returning to the United States. Historically, the Foreign Intelligence Surveillance Act (FISA) generally prohibited warrantless interception of this information exchange. However, the Protect America Act amended FISA so that surveillance of people reasonably believed to be located outside the United States no longer requires a warrant. Your email or telnet session can now be intercepted without a warrant. If all you are concerned about is keeping border agents from rummaging through your revealing vacation photos, you may not care. If you are dealing with trade secrets or confidential client data, an encrypted VPN is a better solution.

Finally, however useful these techniques might be to protect laptops, travelers do not have this array of options for protecting data stored on less configurable smart phones. Of course, many phones do have a lock or password protection option, which travelers might consider enabling before heading to the airport.

In sum, while you must submit yourself and your electronic devices to warrantless and suspicionless searches at the border, you are not legally obligated to decrypt information or reveal passwords. However, if you fail to do so, the border agents may detain or search you, or even seize the device. There are no options that provide perfect privacy protection, but there are some options that reduce the likelihood that a legitimate international traveler’s confidential information will be subjected to arbitrary and capricious examination.

Example Security Precaution

Attorney Alice needs to have confidential attorney-client privileged information overseas. Before departure, she removes unnecessary information, encrypts her hard drive with strong crypto and sets up a login for a protected account and a travel account on her computer. To access the confidential data, one would need to first login to the protected account, and then open the encrypted files. Only Alice’s employer (The Law Offices of Bob) knows the passwords to the account and encrypted data, and keeps them secret until Alice arrives at her destination. Bob then sends the passwords to Alice in an encrypted email message.

Related Issues: Privacy, Travel Screening

Related Cases: US v. Arnold

Telecom immunity: where does your Rep stand?

Where does your representative stand?

For more than five years, AT&T and other telephone companies broke the law and violated their customers’ privacy rights by sending billions of private domestic internet and telephone communications and records to the National Security Agency.

The Bush administration has been lobbying Congress to let the phone companies off the hook. But recently, the House of Representatives stood strong and passed a bill that would hold them accountable.

Enter your zipcode at StopTheSpying.org to find out how your House representative voted on the recent bill denying the telecom industry immunity for their criminal involvement in spying on the American people.

See also:

• EFF: The Case Against Retroactive Amnesty for Telecoms
• Wikipedia: NSA warrantless surveillance controversy
• American Civil Liberties Union: FISA
• Wikipedia: Legal challenges to NSA warrantless searches in the United States

Advertisers may sneak into your brain

We may soon wish the Firefox extension Adblock Plus existed as a neural implant affecting all sensory input:

Study: Subliminal ads warp your brain – CNET

Science has proven, once again, that advertising is effective. Who knew?

Researchers from upset-destined Duke University (fill out those brackets, people) and the University of Waterloo have published the results of a study that suggests that brief exposure to Apple’s brand logo drives higher levels of creativity than exposure to IBM’s logo. In fact, the researchers suggest that subliminal advertising is actually more effective than regular advertising, because people don’t have time to raise their anti-ad defenses.

…etc.

The Reality Distortion Field Is Real – Slashdot

“Apparently, even subliminal exposure to the Apple logo can make you ‘think different.’ Researchers at Duke University subjected participants to subliminal images of the iconic Apple and IBM logos (during what subjects thought was a visual acuity test), and those who were shown the Apple logo generated more creative ideas after the test than did those who were shown the IBM logo. In a second test, subjects exposed to the Disney logo acted more honestly than those who saw an E! Channel logo.”

Prison Nation - New York Times

Prison Nation - New York TimesMarch 10, 2008

Editorial

After three decades of explosive growth, the nation’s prison population has reached some grim milestones: More than 1 in 100 American adults are behind bars. One in nine black men, ages 20 to 34, are serving time, as are 1 in 36 adult Hispanic men. Nationwide, the prison population hovers at almost 1.6 million, which surpasses all other countries for which there are reliable figures. The 50 states last year spent about $44 billion in tax dollars on corrections, up from nearly $11 billion in 1987. Vermont, Connecticut, Delaware, Michigan and Oregon devote as much money or more to corrections as they do to higher education.

These statistics, contained in a new report from the Pew Center on the States, point to a terrible waste of money and lives. They underscore the urgent challenge facing the federal government and cash-strapped states to reduce their overreliance on incarceration without sacrificing public safety. The key, as some states are learning, is getting smarter about distinguishing between violent criminals and dangerous repeat offenders, who need a prison cell, and low-risk offenders, who can be handled with effective community supervision, electronic monitoring and mandatory drug treatment programs, combined in some cases with shorter sentences.

Persuading public officials to adopt a more rational, cost-effective approach to prison policy is a daunting prospect, however, not least because building and running jailhouses has become a major industry.

Criminal behavior partly explains the size of the prison population, but incarceration rates have continued to rise while crime rates have fallen. Any effort to reduce the prison population must consider the blunderbuss impact of get-tough sentencing laws adopted across the United States beginning in the 1970’s. Many Americans have come to believe, wrongly, that keeping an outsized chunk of the population locked up is essential for sustaining a historic crime drop since the 1990’s.

In fact, the relationship between imprisonment and crime control is murky. Some portion of the decline is attributable to tough sentencing and release policies. But crime is also affected by things like economic trends and employment and drug-abuse rates. States that lagged behind the national average in rising incarceration rates during the 1990’s actually experienced a steeper decline in crime rates than states above the national average, according to the Sentencing Project, a nonprofit group.

A rising number of states are broadening their criminal sanctions with new options for low-risk offenders that are a lot cheaper than incarceration but still protect the public and hold offenders accountable. In New York, the crime rate has continued to drop despite efforts to reduce the number of nonviolent drug offenders in prison.

The Pew report spotlights policy changes in Texas and Kansas that have started to reduce their outsized prison populations and address recidivism by investing in ways to improve the success rates for community supervision, expanding treatment and diversion programs, and increasing use of sanctions other than prison for minor parole and probation violations. Recently, the Supreme Court and the United States Sentencing Commission announced sensible changes in the application of harsh mandatory minimum drug sentences.

These are signs that the country may finally be waking up to the fiscal and moral costs of bulging prisons.