I’ll never bring my phone on an international flight again

https://medium.freecodecamp.com/ill-never-bring-my-phone-on-an-international-flight-again-neither-should-you-e9289cde0e5f#.58zrgizib

by quincyla • 9 years ago

135 198 9 years ago

medium.freecodecamp.com

dudul2• 9 years ago

The factory reset seems more practical to me than leaving your phone at home.

trome2• 9 years ago

Also, carry multiple phones of the same model. I've been throwing my main phone anywhere besides in plain view and carrying a couple $5 Androids in my pockets instead when going thru TSA, better they try to search one of them than my main phone buried in my bag next to 2 others that look just like it.

scrumper• 9 years ago

Keep in mind that it's a felony to lie to a customs & border patrol officer. "Is this your main phone?" How will you answer that?

ucaetano4• 9 years ago

"Please hand over your personal phone, not any replacements you carry as decoys"

digler9996• 9 years ago

on a scale of 0-9, I'd put factory reset at about a 5. I'd wager there's still software out there that could do a raw read of the SD storage device's blocks. Unless Apple and friends have the device reset go to extra measures that tell the drive (at the chip-level, not the OS) "report all zeros" when read from, I think to increase your safety to "level 9" you should overwrite the disk by copying a large file several times until all the free space is consumed. Even then, flash drives have more physical storage than they report, but accessing those blocks would be pressing the edge of whats practical except in the most exigent situations.

Edit: I didn't realize virtually all phones' storage is encrypted nowadays.

LamaOfRuin• 9 years ago

Doesn't seem necessary if you had disk encryption enabled. The data remaining unerased on the disk is already meaningless without the key.

psybin9• 9 years ago

All Apple devices are AES encrypted with a combination of a key on flash in the CPU, and a unique static key in the CPU core. "Erasing" the phone just removes the key, rendering the bulk flash storage completely useless. There's never any data stored which is not encrypted.

anotheryou• 9 years ago

When you are rooted you can even make an image before and put it back later I guess.

nkrisc2• 9 years ago

Until you're detained for not having a phone to turn over. I'm only half joking.

trome2• 9 years ago

I recommend having a few $5 Androids on ya, they are both fun to play with, handy, and will throw inquisitive 3 letter agencies for a loop.

psybin9• 9 years ago

"Is this the phone you use on a day to day basis"- felony if you lie.

ucaetano4• 9 years ago

Which will only make you more of a suspect, probably resulting in a deeper investigation or even being denied entry.

rubicon33• 9 years ago

Where does one find an android phone for $5? I must be misunderstanding?

bitwize• 9 years ago

Intelligence agencies aren't stupid. Evidence of attempts to thwart or subvert intelligence gathering is itself suspicious. If the feds seize what looks to them like a burner phone, that may be grounds for them to detain you without trial indefinitely; and may itself become a crime.

digler9996• 9 years ago

My "only half joking" premonition is that in a few years you're going to need a permit to travel outside the US. And I don't mean a passport. I mean an application that is either approved or denied each time you want to go somewhere. And if you dont stick to the approved itinerary (or you dont come back), feds come bring you back and charge you as a felon.

Each one of these border issues (phone passwords, checkpoints inside the US, travel bans) increases the total law enforcement "resistance" we face when traveling internationally. As the resistance increases, at what point does it become an "open circuit" ?

yetihehe• 9 years ago

My "only half joking" premonition is that in a few years you're going to need a permit to travel outside the US.

Just like during communism in Poland. My parents told me such stories. I think they wouldn't believe me if I said them that it looks like it will be implemented again in USA.

antisthenes• 9 years ago

I have a prepaid plan that only works in the US anyway.

I never bring my US phone on international travel, because it just won't work. Instead, I carry a cheap Chinese GSM phone that's wiped before every trip and preloaded with some music and entertainment videos (TV Shows, etc.)

I buy the sim-card at my destination and throw it away when I go back to the States.

I'm not sure this solves anything, but then again, I don't work for a company that makes me required to be able to access sensitive data from any point in the world. YMMV.

rch2• 9 years ago

Phones should load different profiles based on the password provided, with some activity logged across profiles so none of them appear stale.

Spooky238• 9 years ago

You're implying that people should behave in a manner that is a serious felony in the United States and likely other places.

sosborn• 9 years ago

Honest question: How is that a felony? I have multiple profiles on my home machine. Does that make me a felon?

bionsuba• 9 years ago

   that is a serious felony in the United States

How so?

tqkxzugoaupvwqr• 9 years ago

What is the felony exactly?

benologist• 9 years ago

What is the maximum extent to which we can defend users of our software?

admax88q3• 9 years ago

Phone's should have a travel mode, where it backs up all your data to the cloud and wipes the phone clean.

eridius12• 9 years ago

Why does that need a special mode? Just back up your phone and factory reset it.

vatotemking2• 9 years ago

What if the agent forces you to give them the password for "untravel mode", which restores data to your phone from the cloud?

6t6t6t62• 9 years ago

Most of the information on Android phones is stored on the Cloud. Someone can factory reset their phone before crossing the border, create a new empty profile* just to show it to customs and, once they are in a "safe zone", factory-reset it again and load the good profile that will automatically download the user data and apps.

* Just to make the customs agents happy, I would fill the history of the fake profile with porn and pictures of donuts.

gyger• 9 years ago

I suggest mentioning in the title that it concerns the US-border, I travelled across a lot of international borders, that didn't care. Only some international borders are a problem, one of these, the US one.

Spooky238• 9 years ago

It's always a risk.

We're fortunate to live in a timeframe where this sort of bullshit has been unusual up until now for most people.

Ask a US citizen of Pakisanti descent about travel to India sometime. International conflict gets taken out on poor saps trying to travel all of the time. Sometimes it's petty chickenshit, sometimes real.

ThrustVectoring• 9 years ago

I know of companies that do not allow employees to bring work devices into China. That's probably a somewhat different issue of industrial espionage, though.

type02• 9 years ago

Then I'm sure US is doing fine in that regard, because american agencies are morally superior to be involved in such a thing, cogh, cogh...

capote5• 9 years ago

It would be nice if there were a feature built in to phones to facilitate this. Like, on the lock screen, an emergency wipe button that runs a procedure you specify (log you out of everything, obfuscate which services you subscribe to, etc) and this way as you're going through customs, you can gauge your risk and at any point you feel uncomfortable, you discreetly click your button before smoothly handing over your phone and password with a warm smile.

psybin9• 9 years ago

The area you are frog marched into is strictly no devices allowed, if they see you with any electronics in your hand you will be pounced upon. This is very obviously because people try to destroy evidence they have on their devices once they discover they are screwed.

jedberg2• 9 years ago

They claim to be device free, but yet everyone has their phones out texting and doing email as they wait in line. I've never seen a border agent even say anything, much less march someone away.

As long as you aren't taking pictures of the procedures they don't really care.

capote5• 9 years ago

Nah, I'm sayin the area leading up to passport control or in the baggage claim area. I realize once you're sure something sketchy is happening, there's no actions left to take anymore. I pretty much have my phone out and in my left hand 100% of the time I'm in airports/planes, so nothing suspicious about right as someone's coming up to you or right as you walk up to a CBP officer you just tap a button.

anigbrowl5• 9 years ago

This suggestion comes up in every single thread. Consider that when such an obvious gambit seems to exist you're almost certainly not the first person to have come up with it, and there's a reason it hasn't already taken off.

capote5• 9 years ago

I realize I'm not the first person to come up with most ideas I have. I don't mind.

Care to share the reason it hasn't taken off? Or are you here just to call me out?

andr• 9 years ago

I'm interested to see how Apple will react to this, given their history with the FBI. Right now, you can connect your iPhone to a computer and get all the information off it - doesn't matter if you are iTunes or Cellebrite. It'd be good to have a permanent way to disable this ability in the future, so that your phone data cannot be siphoned out, even if you provide the PIN. Of course, that's not the only way for data to be extracted, but all other options would be considerably slower and less practical.

eridius12• 9 years ago

Apparently there already is. It's called Pair Locking, and it's something you can do with Apple's Configurator software. Forensic data dumpers use the same functionality that iTunes uses to talk to the phone, which uses a process called "pairing", and Pair Locking makes it so the device refuses to establish any new pairs.

helpfulanon• 9 years ago

Fun fact - the "border zone" in which your 4th amendment rights are suspended and you are subject to search, is 100 miles wide and overlaps where the majority of Americans live and work

https://www.aclu.org/other/constitution-100-mile-border-zone

mnm1• 9 years ago

If you can't change the constitution/law, redefine the meanings of words and you get the same tyranny.

temp-dude-87844• 9 years ago

Every time I see this map (which, AFAIK, is a visualization by the ACLU and not based on an official government publication) I wonder why Chicago and the coastline of Lake Michigan is included. The border with Canada runs diagonally down the length of Lake Superior, clears the Straits of Mackinac by at least 40 miles, and then continues southeast along Lake Huron to Sarnia and Detroit.

The entirety of Lake Michigan is within the borders of the US, so while this entire "100-mile border zone" business is bizarre enough as it is, it's truly disingenuous to include the lower Lake Michigan coastline. It makes me wonder if this is an interpretational liberty taken solely by the ACLU, or if the government's demonstrated behavior truly justifies what is shown on the map.

greglindahl• 9 years ago

So what did the ACLU say when you contacted them? I'm curious how it turned out.

maxerickson2• 9 years ago

If you are sailing you apparently you only cross the border when you dock your boat.

http://www.great-lakes-sailing.com/canada_us_border.html

I guess sailing from the Canadian shores of Huron to somewhere in Michigan wouldn't be all that weird.

chadgeidel2• 9 years ago

Wow, I thought that only extended OUTSIDE the border, not INSIDE as well!

dudul2• 9 years ago

What? That doesn't make any sense. Constitutional rights don't apply anywhere outside the border as far as I know. In this context, the area can only extend inside. Or do I misunderstand your comment?

chillingeffect• 9 years ago

and worse, it technically includes all ports. which could basically mean radii around every international airport.

when i first learned about this, I scared my lawyer girlfriend about it and she helped me look into the actual court cases. they have been somewhat difficult to hold up. usually because LO abuses the rules by not following the three terms listed above. and it still takes getting all the way to Supreme Court which is a massive drain on resources for those typically affected by this.

yread• 9 years ago

Well, you're not completely wrong but there are additional tests for search http://blog.constitutioncenter.org/2013/02/does-a-constituti...

Searches within the 100-mile extended border zone, and outside of the immediate border-stop location, must meet three criteria: a person must have recently crossed a border; an agent should know that the object of a search hasn’t changed; and that “reasonable suspicion” of a criminal activity must exist, says the CRS

oAlbe3• 9 years ago

Since most of our private data is stored in the cloud — and not on individual devices — you could also reset your phone to its factory settings [...] Then if you’re asked to hand it over, there won’t be any personal data on your phone

This makes me wonder: is it true? Is the data truly unrecoverable if you factory-reset your phone? I doubt so. But maybe there's some special tool to truly wipe a device (say like the equivalent of DBAN)

psybin9• 9 years ago

At least on an iPhone, erased is erased. On android some versions use full disk encryption but many do not, it's a guess.

ajross2• 9 years ago

It's not a "guess". The last Android release that lacked support for block-device-level encryption was KitKat, which shipped in 2013. Any device being advertised with the "Android" trademark (to be fair: AOSP-based clone OSes like Amazon's have been slower to evolve) over the last two years has that support.

Please don't hijack an important security discussion to engage in meaningless platform flamage. Users with Android phones have this available and they should enable it, not be told that they need to "guess".

Veratyr• 9 years ago

On most recent phones, the system is encrypted by default and a factory reset erases the keys, which does make it unrecoverable (unless the key is elsewhere, which I haven't heard of).

eridius12• 9 years ago

Definitely unrecoverable. The whole point of the feature is to make it impossible to recover the data once the key is erased, so you can be sure they're not storing a backup anywhere as that would defeat the point.

accountface2• 9 years ago

They can detain me indefinitely if they want, I will never give my pin to border security. I'm not going to bend to this bullshit by not carrying a phone.

korethr• 9 years ago

It's easy to say that now. When the pressure's actually on and a person now has things at stake, priorities can change, and yielding starts to look like the eminently sensible thing to do.

I suspect your tune may change when you find yourself in indefinite detention, have missed your connecting flight, and your family/friend/spouse/boss has called said phone and been told by CBP that you're refusing to comply with an investigation.

accountface2• 9 years ago

No.

If my peers find it acceptable that I am detained indefinitely simply for not unlocking my phone, then throw away the key because all is lost.

yakshaving_jgt• 9 years ago

“Land of the free.”

DanHulton• 9 years ago

My current plan is to wipe my phone before travel and restore it on destination. Nothing to unlock because there's no phone there.

Forcing you to restore your entire account is a whole 'nother level beyond simple forcing you to unlock your phone.

maxxxxx2• 9 years ago

How do you do that with an Android phone? With iOS this seems pretty easy

hrehhf2• 9 years ago

I have used the Android development tools to make backups over USB and it is fast. You can install just the command-line tools from https://developer.android.com/studio/index.html#downloads and use:

    adb backup -apk -shared -all -f backupname.ab
    adb restore backupname.ab

js2• 9 years ago

They may choose to detain you anyway, and force you to give them passwords to various accounts manually. But there’s no easy way for them to know which services you use and which services you don’t use, or whether you have multiple accounts.

This would seem to imply lying, or at least deceiving, a federal agent. IANAL, but https://en.m.wikipedia.org/wiki/Making_false_statements

ruslan_talpa• 9 years ago

Well ... two can play that game "any matter within the jurisdiction" of the federal government of the United States and since you are not in that jurisdiction this does not seem to appply :)

inestyne• 9 years ago

Try 'I am a born in America citizen on american soil, I want to talk to my lawyer, no i'm not giving you my password. No I won't tell you why.'

brachistochron• 9 years ago

I had same strange situation a week ago when passing Ukraine border. Whats purpose of this?

DigitalJack2• 9 years ago

I wish Apple would have a duress password that when entered would wipe the phone.

aplomb• 9 years ago

If you have a Nexus Android phone, just change to guest mode or add another user. It's a seldom used feature and limits what people can see or do with your primary account - inspectors are unlikely to know as it's fairly low-key when users are swapped

pfarnsworth3• 9 years ago

But if they do know, that's a good way to get yourself banned from entering the country for lying to a border guard.

slyall• 9 years ago

I read the comments here and I'm reminded of a Tweet I read yesterday:

"Next programmer bro who explains his clever travel information security hack has to change his name to Mohamed Hussein Ali and try it at LAX"

https://twitter.com/thegrugq/status/831316334973579264

yawz• 9 years ago

Then if you’re asked to hand it over, there won’t be any personal data on your phone

That would probably look even more suspicious.

taylodl3• 9 years ago

Seems to me Apple and Google should be working on "roaming profiles." You can reset your phone to factory settings, or even get a rental phone at your destination, and then quickly restore it from your profile. After all it's the data you're interested in, not the device per se.

eridius12• 9 years ago

How is that any different than just backing up to iCloud and restoring it to a new device?

pfarnsworth3• 9 years ago

Can border agents force me to reveal my personal email address and password?

jdalgetty• 9 years ago

When someone creates a dumb phone with a great camera and GPS this won't be a problem for a lot of travellers.

greenyouse2• 9 years ago

Once customs and border patrol is holding you is there any way to back out? Could you say something like "Uh... I think I'm just not going to enter right now."?

(then back up your data, ship the computer device with an insurance policy, and give the border crossing another shot)

outworlder2• 9 years ago

Certainly, 6 months later, when you are cleared for a hearing after getting deported to who knows where.

Don't try shenanigans at the border.

greenyouse2• 9 years ago

OK, fair enough. Maybe just plan to not have your device like the article says.

deathanatos• 9 years ago

(IANAL) If you're a US citizen, indefinite detainment without cause is unconstitutional: they must release you eventually; you also (provided you have your passport/can prove citizenship) have a right to enter your country. Further, if they try to detain you indefinitely illegally, you have the right to a writ of habeas corpus — a legal challenge that your detainment or jailing is illegal (your jailor must go before the court and show cause that he/she has the right to hold you). (Though, if you are in this position, you may need someone to file it on your behalf.) Again, I'm only asserting this in the specific situation of a US citizen attempting to enter the US.

My understanding is that they are permitted to search you, for the narrow purpose of border security. (I.e., the search here is not a violation of fourth amendment rights.) But I don't see how they can force you to divulge your password. You might not get the phone back, though, and they'd likely make your life very difficult; it's probably better to not mess around with them, and plan ahead. Specifically, I don't think leaving and trying again is ever an option, and wouldn't look good to the officer.

dgudkov• 9 years ago

You can. You have the right to withdraw the border crossing submission which is what you effectively do when you try to cross the border. I once was denied entry to the US and the CBP officer offered me to make it as I'm withdrawing my border crossing application in order to make the consequences less severe.

colemannugent2• 9 years ago

This might have been suggested before, but I think it's novel enough to repeat:

You should be able to create two passwords for all devices. One, your password, would allow you to use the device normally, the other, your lastword, would start a silent erasure of the device. The device could even present a fake successful authentication, like dumping you to some fake desktop, while it erases your data.

While in this case it would not really benefit someone in situations like US border crossings who have almost no rights, I think it would be very effective at discouraging attempts to force people to divulge their passwords, as the person entering the lastword would effectively be informing the device that it was under attack. With something like this I would think that questioning people for their passwords would be pointless.

outworlder2• 9 years ago

And then you get prosecuted for destruction of evidence, obstruction of justice and whatever else they can come up with.

As said in other threads, the solution is not technology.

colemannugent2• 9 years ago

This assumes that law enforcement actually knows you will have evidence.

If the technology could remove everything that would be incriminating and leave benign data you would just be another non-techie traveler.

maxerickson2• 9 years ago

There are lots of situations now where using such a duress password would be a crime.

If it became commonplace, providing such a password to law enforcement would likely be criminalized.

The simpler way to deal with it that doesn't involve the potential of breaking laws is to carry a travel device and straightforwardly identify it as such if asked. Or don't carry any device at all.

6t6t6t62• 9 years ago

With a laptop, this seems trivial: just create a second user in the system with some data (so it does not look empty). Then create a login script that deletes the data of you primary user and deletes itself. Nobody would ever realize what happened (except with forensic tools).

Tepix• 9 years ago

Feature Request: set auto-wipe on your phone that cleans it unless you enter your cancellation code within the next x hours.

spaghetti-guy• 9 years ago

Signed up to pose two questions :-

1/ I legitimately do not know a lot of my usernames and passwords. I sign up with a unique email that includes the name of the site (I'm not particularly religious about the format of this and usually end up checking previous email to figure it out). Passwords are saved in Chrome and I mostly don't remember them. I'm sure I am not unique. Where would one stand with this scenario?

2/ Wherever I can, I use a U2F device as a second factor. Could one be compelled to provide this along with the passwords (providing I can remember them)? Where would one stand if the key was unavailable - i.e. lost/left at home? Assuming they have a PC nearby for checking your social media accounts, I'd very much doubt it had it's USB ports enabled so, even if I did provide it, I would suggest they probably couldn't use it. Is there any documented precedent for how this is handled?

lamerman• 9 years ago

"And you can bet that countries like China and Russia aren’t far behind" - I am a Russian citizen and I cross the border of Russia very frequently and I cannot agree with the statement. The worse thing I've been asked about was "what is the goal of your trip". Getting your phone on the border of Russia is something impossible, it's just unimaginable. I've never been asked to show anything except for my passport. At least now and for the time before this moment.

effingwewt• 9 years ago

How sad that by now it's far easier to simply mail your stuff to yourself, pick it up on arrival to destination, and mail it back to your house before departing. I am beginning to hate my country so bad I can't wait to get out. It feels nothing like the country I grew up in.

setikites• 9 years ago

Why not ship your phone to yourself at your destination?

nojvek• 9 years ago

In this age of digital instant copy, Facebook has made a lot of things the norm. I watch TV shows and cyber stalking is seen as normal.

A good friend of mine was blackmailed by her boyfriend that her sensitive pictures would be released on the Internet if she didn't return his calls. It was the first time she realized that what was considered silly can really be very serious. She deleted her Facebook and Twitter account.

I really want to see a big hack, sort of a global financial crisis level on the surveillance govt is collecting for people to realize this shit can really fuck society up.

janstenpickle• 9 years ago

OK, those of us who know better travel without phones, what about people who don't know better but have received information from me? The data about me on their phone cannot be protected by me.

hysan• 9 years ago

If your rights are suspended at the border, then whose rule of law does apply? Clearly not the US, then would it be the neighboring country like Canada? Or is it some sort of no mans land? With more and more of these stories bringing up the lack of 4th and 5th Amendment rights, I'm becoming curious as to what can legally happen at the border. How would common crimes be handled in this area?

I’ll never bring my phone on an international flight again

Related Stories