US Border Patrol says they can create central repository of traveler emails

https://viewfromthewing.com/us-border-patrol-says-they-can-create-central-repository-of-traveler-emails-keep-them-for-75-years/

by hispanic • 6 years ago

406 319 6 years ago

viewfromthewing.com

dannyw• 6 years ago

I hope someone challenges this in court.

TedDoesntTalk• 6 years ago

EFF or ACLU, I hope.

wffurr3• 6 years ago

Too bad neither party shows any signs of reigning in this kind of overreach by CBP. Doesn't seem like this can be fixed by voting.

slg4• 6 years ago

Neither party might go as far as you want, but it is also a mistake to think both parties are completely identical in their views of this sort of behavior.

sthnblllII3• 6 years ago

How could two organizations of thousands of people ever be completely 100% identical, and why does that matter at all if neither party has rolled back these massively unpopular policies, even when controlling both houses of Congress and the executive?

coldtea2• 6 years ago

Doesn't really matter if their vectors still point to the same general direction...

hutzlibu• 6 years ago

Not a US-citicien - enlighten me please. To me I don't see any difference when it comes to spying on foreigners.

kevin_b_er• 6 years ago

One wants it massively expanded. The other is ambivalent on if it should be fixed. They are not the same.

wffurr3• 6 years ago

Did I claim they were the same? The result is the same in either case anyway. Power is a one-way ratchet.

samatman4• 6 years ago

Wait, which is which?

Who controlled the executive at the time of the Snowden revelations? Remind me.

Perhaps you mean one is more open about their common policy goals than the other? That may be true, but it's cold comfort.

GordonS3• 6 years ago

This is one of the biggest problems with modern Western democracies - there are some thing (a lot of things) that governments do to work against their citizens that voting simply will not change. It feels so futile...

NotSammyHagar5• 6 years ago

We just have to keep increasing the visibility of this issue. Don't give up, I'm not giving up. I don't expect Biden to change this unless there is a very very large groundswell of people complaining. AOC and Sanders seem like people that could understand the reason why this is bad behavior.

OminousWeapons2• 6 years ago

Ballot measures are one way you take this on. You make it explicitly illegal for companies to have over data on users from your state unless a warrant is produced. This won't stop entities from tapping fiber or attacking companies and stealing data, but it does stop companies from just handing stuff over voluntarily.

bostonvaulter2• 6 years ago

This is an example of why we need more viable political parties. Which is why we need a better voting system (ranked choice, approval, etc) so that other parties can become viable and start influencing politics. Of course neither of the two dominant parties want their power reduced in this way.

jasonwatkinspdx• 6 years ago

While I understand the frustration please don't make false generalizations like this. There are several people with a consistent track record of pushing back on this stuff, like Wyden.

wffurr3• 6 years ago

One senator on the left wing of his party who has been persistently unsuccessful across several administrations of both parties.

You are making my point for me.

mrandish• 6 years ago

The (distant) third largest party behind the other two, the U.S. Libertarian Party, certainly would curtail this kind of overreach.

RyJones• 6 years ago

If this is the case, I’ll leave the country with basically naked devices which I’ll restore on the other side of the checkpoint.

curiousgal• 6 years ago

They'll just consider that suspicious and confiscate the devices ¯\_(ツ)_/¯

Scoundreller2• 6 years ago

Dunno about CBP, but I know the Canadian border agents are restricted to searching the phone only.

So anything in the cloud (e.g. webmail) is off limits unless you download to your phone.

deeter72• 6 years ago

Worse they might flag and track you meticulously.

teddyh• 6 years ago

Even if this works for now, for you, you have only solved the problem for yourself. But the problem of privacy is a collective problem in society, so unless most people have privacy, you don’t have it, either.

This would be like commenting on censorship/non-free speech laws that you’d solve it for yourself by using Tor or some other anonymizing method. That would not solve the problem of a society which will lack free speech, and if a society did not have free speech, you would have problems, even if you’d manage to somehow get free speech for yourself.

hcnews4• 6 years ago

Most likely solution isn't either/or between two options but rather both. Lots of people will start doing this and make it more accessible for the common man while others are getting the law changed (if).

retrac• 6 years ago

Docker for phones. Encrypt and upload image to server. Wipe. Cross border. Download and decrypt. Image.

It could probably be implemented as a one-click service on some devices.

oldsj• 6 years ago

This is the present day experience of wiping an iPhone and restoring it from iCloud. It’s really that simple, but in general it’s unencrypted

jhart99• 6 years ago

I've been doing this while going between the US and China. Once you get used to it, it is only a few minutes of hassle to restore everything. If it is so suspicious, they should have no problem articulating that to a judge and getting it from my email provider or my storage provider. But I suspect they only do it because they can and if you add even a tiny bit of friction, they won't bother unless there are other things that make them suspicious.

HenryKissinger• 6 years ago

Imagine the private letters of people in 1945 being of any use to a border agency in 2020.

fierarul• 6 years ago

You mean the letters of some publicly unknown sympathisers of unsavoury policies back in 1945? They would be of much use to state agencies.

rudiv• 6 years ago

I'd love to see your private correspondence, Mr. Kissinger. Preferably as part of the legal process of discovery.

(Sorry, it's off topic but I couldn't resist)

ip26• 6 years ago

Sounds like a call to start crossing the border more frequently- with a suitcase full of "suspicious" drives.

How many petabytes of mirroring before the whole operation becomes too expensive to justify?

dagmx2• 6 years ago

If they have an auto extraction script, could also put a zip bomb in there

ceejayoz3• 6 years ago

I don’t have enough faith in the legal system to try that one.

jpitz• 6 years ago

Or a hard drive shell with a Raspberry PI inside doing the equivalent of piping out /dev/random to the interface.

andrewnicolalde• 6 years ago

This made my day hahahaha. How long do you reckon it would take for someone to catch on?

2OEH8eoCRo02• 6 years ago

US law enforcement has such a great sense of humor afterall...

gruez7• 6 years ago

If it's encrypted it will probably end up in blob storage, which is low cost. If you want to hit them where it hurts, generate tons of fake text (stored as emails, documents, texts, etc.) with GPT-3 to clog up their elasticsearch server and/or NLP classifiers.

tomc1985• 6 years ago

You don't need an RPI to do that, the drives have their own SOC and firmware

Kapura2• 6 years ago

The Snowden leaks showed that the NSA has built the capacity to spy on essentially the entire internet. You really think they'll balk at a few petabytes?

Shared4048• 6 years ago

I mean, that's the NSA. Does the border patrol share resources?

That being said, you are of course correct.

gonzo41• 6 years ago

I've heard that 5 eyes can only process 20 precent of what they collect a day. I'm not sure what they do with the 80% at the end of the day considering that pipe is constantly getting more feeds.

zxcvbn40382• 6 years ago

Yes but this isn’t the NSA, this is the border patrol, operating with a fraction the budget and expertise of the NSA. The people doing the copying are basically security guards that couldn’t pass the police physical nor find work as teachers.

I really like the idea of a hacked hard drive or phone which generates a never-ending series of files containing terabytes of random data. I bet any given boarder crossing will only have the ability to scan two devices at a time, so bring a couple and you can probably shut down everything as they scramble to figure out what to do when their local storage fills up.

StartupTree8• 6 years ago

This is HackerNews, so you're going to get called out on such nonsense. There is no technical capability to "spy on the entire internet". If you truly believe this, then you are probably consuming propaganda.

rorykoehler• 6 years ago

Petabytes of deepfake porn featuring US Border Patrol chiefs

dade_• 6 years ago

Best to be deepfake granny & grandpa porn. Is there anyone working on that yet? The US legal system being what it is, I expect it will be necessary to prove the deepfakes are legal adults that consented to the filming.

smnrchrds• 6 years ago

I imagine they would seize the drives and give you a receipt. And then, a year or two later, they give you a call to tell you they are releasing the drives and you can pick them up. Isn't that what happens to computers that are seized as a part of a police investigation?

sneak4• 6 years ago

Yes, except for the part about the call where they give you anything back.

analognoise• 6 years ago

This is the difference between reality and theory.

In theory, you'd be fighting the system.

In practicality, you'd probably end up in some black site, disappeared.

I recommend against doing stuff like this.

nichos• 6 years ago

Government never cuts projects because they're too expensive. They live well outside of their means. Cost is never a consideration.

KineticLensman• 6 years ago

Government never cuts projects because they're too expensive

'never'? Rising costs is a common factor in numerous cancelled projects, at least in the UK defence market that I'm familiar with.

luiperd• 6 years ago

What's a reasonable way to protect yourself here? Other than wiping and restoring. Are there any encryption tools, or ways to keep your emails and other data on your device safe?

Can CBP make you unlock your own phone?

kortex• 6 years ago

From all I've read, they will certainly try, even if they don't technically have the authority (I don't know if they do or do not, but CBP has broad authority). Encryption also incurs their ire.

You need to either wipe the phone or have stegnograpic volumes.

It's a sad state of affairs.

traceroute66• 6 years ago

One word. Jurisdiction.

What is on the device in their hands, on US soil, is subject to their stupidities, whatever those stupidities may be on the day their grubby hands get hold of your phone.

What is located remotely, in a privacy conscious jurisdiction, say Switzerland, is outside of their remit. I know US courts like to think they have power over the world, but they don't. US courts and US law power stops at US borders.

The trick is to make sure nothing gets cached on your local device (including authentication credentials, obviously). A bit like the old Thin Client computing really.

If you want to go one step further, don't travel with working credentials. Rely on someone outside of US jurisdiction to provide you the last piece of the jigsaw in a secure manner once you are in a safe location.

aneutron2• 6 years ago

Well, in theory, yes. In practice, there have been recorded instances where the US Government has asked people to disclose their social media [1] and in other ones (I failed to find the source) refused access to people who refused to log into their accounts.

Also, if you're a non-american traveler, all the constitutional rights you're afforded as an American don't apply. So they can pretty much ask whatever and refuse you access for any reason.

It's like the US is becoming more and more like China. But it's a worlwide trend, really, with old men screaming "We're gonna be in the dark !" ... It's thoroughly depressing.

Edit: As written down in the comments, the part about foreigners' rights is wrong. See comment for correction.

[1] https://www.theverge.com/2016/12/22/14066082/us-customs-bord...

marcrosoft2• 6 years ago

US law power stops at US borders.

This also means US companies can ignore GDPR.

rebuilder• 6 years ago

True, but if you are on US soil, you fall under US jurisdiction for, e.g., contempt of court.

dragonwriter7• 6 years ago

US courts and US law power stops at US borders.

No, it doesn't.

US “law power” extends as far as the enforcers of that power are able and motivated to extend their reach, which very often extends far outside of US borders.

OTOH, there's places and contexts where that reach tends to encompass more casually and with less case-specific motivation.

jorblumesea• 6 years ago

That's not really accurate. The US, due to its historical position as a super power, has extradition treaties for many countries around the world. If charged with a crime in the US, your physical location might not matter.

It very case/situation specific. The host country might block extradition for various reasons, but often, the US has global reach.

anonunivgrad• 6 years ago

That’s not true. A US court can order you to go to another country, retrieve documents, and bring them back to the US, even if you doing so is in violation of that other country’s laws. This is more reasonable than you might think, because otherwise companies and individuals could hide all of their incriminating data in such ways and evade accountability under US law.

Further, being involved in any violation of or conspiracy to violate American law is a crime, even if you never actually step foot in the US. Companies can be sued in US courts for actions they took overseas. None of this is particular to American law, the same is true in any advanced legal system. American law just has particular significance because of American economic preeminence. Some of the most vexing legal issues, both theoretical and practical, surround this cross-border application of law. And I guarantee you wouldn’t like the result if countries took a strictly physical, territorial approach to their legal authority.

pmoriarty• 6 years ago

It's interesting that you single out Switzerland as a jurisdiction that the US can't touch.

It used to be that Switzerland had iron-tight bank secrecy regulations that the US (and the rest of the world) really couldn't breach. Yet over the years the US has managed to force massive changes on Switzerland's financial institutions, and for decades now there's been much more transparency, and Switzerland's banks are not nearly as secret nor as effective at hiding assets as they used to be.

Apart from getting other countries to change their financial regulations to be more in line with what the US wants, the US has also been very successful in doing the same in regards to issues like drug enforcement, human trafficking, child molestation, and many other issues.

So, depending on your threat model and what data you're trying to keep private, I wouldn't count on any jurisdiction ultimately being and remaining safe for your data.

Something else to consider is that once your data is out of your hands, it's easy for whoever has it to make a copy to archive and work on at their leisure. Even if they don't share, sell, compromise, or trade away that data today, that doesn't mean they won't do so at some time in the future when laws, technical capabilities, or incentives change.

gred2• 6 years ago

Calling your congressman makes the most sense, IMO. As technologists we have an inclination to jump to the technical workaround, but the workaround should not be needed to begin with.

mlthoughts20184• 6 years ago

This would have no effect. “Call your congressperson” should never, under any circumstances, be considered useful or effective.

Policies are decided in the interest of plutocrats. Very occasionally when it would generate good PR or if disenfranchisement gets too bad, some retroactive number fudging will be used to whip up a press release or report on the number of calls or letters to a congressional office, as if to make it seem like a policy was affected by democratic consideration of constituents, but that is purely theatrics and publicity and has no bearing on or connection to the way congressional offices pursue legislation.

tazjin• 6 years ago

Don't go to the US.

refurb• 6 years ago

Don’t go to Canada either. They also force you to unlock your phone.

robin_reala• 6 years ago

Avoiding visiting the US is a good start. If you live there already, I guess avoiding leaving?

the8472• 6 years ago

And don't come within 100 miles of the border.

nwallin• 6 years ago

There are a plethora of full disk encryption tools. Linux has dm-crypt, Windows has BitLocker, iOS and Android have it. I assume there's a way to enable full disk encryption in OSX but I'm not familiar with the ecosystem.

They can force you to unlock/provide password to your devices if they have probable cause that there is evidence of a crime on the disk. Typically this is because someone looked over a shoulder and saw child porn on the screen. I'm not aware of anyone being forced to provide passwords or keys in any other circumstance, but I'm not an expert.

Encrypt your data, keep your devices off. Do this even if you have "nothing to hide".

peterwwillis2• 6 years ago

What's a reasonable way to protect yourself here?

Contact your representatives in government and tell them to make legislation banning this practice. Donate to the ACLU.

762236• 6 years ago

FedEx. Don't carry the devices on you.

mcguire2• 6 years ago

Two words: tamper evident packaging.

inetsee• 6 years ago

If you're seriously concerned about the security of the information on your phone, you could look at the NSA's Security Configuration recommendations. [1] These recommendations are intended for "Apple iOS 5 Devices", and many of the recommendations sound like they would not be appropriate for the average traveler.

[1] https://apps.nsa.gov/iaarchive/library/ia-guidance/security-...

What I would recommend is to keep as much information off your phone as possible. Save emails on your personal computer, and delete them from your phone before traveling. Log out from online accounts like web-based email accounts before traveling. Don't have sensitive files on your phone; encrypt them and download them from a server somewhere that you control.

Finally, as "sumanthvepa" recommended, "keep all interactions with (Border Patrol Agents) on a cordial basis and cooperate immediately and completely when ordered."

M2Ys4U• 6 years ago

What's a reasonable way to protect yourself here?

Refusing to travel to the United States would prevent this from happening.

neltnerb2• 6 years ago

You could try to push your luck, if you're an American citizen.

More realistic is to just wipe your phone and reset it to factory settings using a throwaway google account. They probably won't ask for it but that way it looks unremarkable and you don't have to waste your time arguing with them.

I wouldn't even bring a computer across the border anymore, at least not for a vacation. I always use full disk encryption and I am not interested in giving the CBP (which I'm sure has great IT security) copies of all my confidential work documents to just leave sitting around for the next 20 to 75 years waiting to get exfiltrated by who knows what hacker group will get to it first.

Marsymars2• 6 years ago

Chromebooks are great for this - they're fast to wipe and fast to set back up. I travel with a Chromebook and a phone that I wipe before crossing international borders.

hughw• 6 years ago

Wiping and restoring is underrated. I feel pretty safe about my Apple encrypted cloud backups. It's a minor inconvenience to wipe the phone before crossing the border, and restore on the other side.

Now - if they can make you restore in their presence, that would be a big problem.

Terretta• 6 years ago

Easiest, leverage USB restricted mode: https://www.theverge.com/2018/7/10/17550316/apple-iphone-usb...

Reasonable: use Apple's free device management app and lock out sync to any other / unknown hosts, along with a few other settings.

Note that 1Password for iOS has a travel mode for this situation as well.

jomnasi• 6 years ago

VeraCrypt encryption tool for one, offers hidden encrypted volumes. If I remember correctly, you would have 2 passwords for the same encrypted container. One pw for a decoy volume if forced to decrypt your files such as in this case, other pw would reveal your true data.

ff7c11• 6 years ago

So do I just need to fill my computer with porn? Or use stenography to put all my files inside porn.

orblivion• 6 years ago

Only the most legal, unpleasant porn.

sleavey• 6 years ago

That bit I don't get. Why are they happy to upload arbitrary data to their servers unless it's porn?

arkanciscan2• 6 years ago

"US tax dollars paying to store petabytes of porn, news at eleven"

greggyb• 6 years ago

Make sure you have legally obtained copies of porn if you do this. Unfortunately, it does not seem unreasonable to me that doubly illicit images (copyright-violating porn) could lead to a cause of action against the holder of the hard drive.

SippinLean2• 6 years ago

There are a handful of state courts in the US that find passwords testimonial, and therefore the Fifth Amendment prevents compelled production of passwords. [1]

Could that apply here?

1 https://www.techdirt.com/articles/20191124/09372943445/penns...

tenuousemphasis4• 6 years ago

Borders are constitution-free zones, didn't you know?

SippinLean2• 6 years ago

Most of those cases have been related to the 4th, not the 5th right?

Hnrobert426• 6 years ago

Actually, the First Congress okayed border searches. Given that many of them were authors of the Constitution, it stands to reason that border searches were always intended to be allowed under the Constitution, even if not stated explicitly.

https://www.law.cornell.edu/constitution-conan/amendment-4/b...

jarym2• 6 years ago

Really, the US system of manually extracting data from peoples physical devices seems so much more old-fashioned compared to the Great Firewall of China.

There really isn't much difference conceptually between the two systems.

karaterobot2• 6 years ago

That's an overstatement. The conceptual difference is that the U.S. system is limited to specific, known, legally prescribed situations, while the Chinese system is constant and ubiquitous. The U.S. system is far from perfect when you get down to specifics, but I'd definitely take it over the Chinese system.

jarym2• 6 years ago

limited to specific, known, legally prescribed situations

Not sure crossing the US border in either direction or being within 100 miles of it (the 'extended border area') is particularly 'limited'?

tempodox• 6 years ago

What the NSA does is just as constant and ubiquitous as what China does.

dvduval• 6 years ago

Uninstall everything before crossing the border? The 100 miles thing is the weirdest though, especially if enforceable on someone who has not recently/ever crossed the border.

progfix• 6 years ago

Can't they just ask the NSA for the Emails?

coronadisaster3• 6 years ago

They probably don't even have to ask because they have a direct pipe.

hamiltont• 6 years ago

Really wish I could enter a fake password on my Android device to launch a fake persona

zabana• 6 years ago

this is a great idea actually. or simply manage fake social media accounts with a fake persona that you update semi frequently either by hand or through an automated script. Login to these accounts upon arrival, then switch back to your real ones when you're clear.

StartupTree8• 6 years ago

This would be a serious offence which would get you banned from the US for life, after serving a jail sentence.

StartupTree8• 6 years ago

It's a serious offence to present a fake identity to US Border Patrol.

ianleeclark2• 6 years ago

They're very clearly not meaning an entirely different identity, but instead some sandboxed, non-personal phone space.

mercora• 6 years ago

i do use multiple profiles on my android phone where the main one is not the one i actually use. I wonder if they would catch that as its kinda obvious if you know to look for this but actually somewhat hidden if not...

mlazos• 6 years ago

Hmm could you not just encrypt your data and leave the key at your house and throw one away before you reach the border. They can have all of the “data” that they want.

kayodelycaon• 6 years ago

And then they can deny you entry into the country.

If you’re a citizen, I don’t know if they can seize property, but if they can, you won’t be able to cross the border with it.

tenuousemphasis4• 6 years ago

The article says this is for people both entering and leaving the country. And applies anywhere within 100 miles of a "border" (including coasts).

sumanthvepa• 6 years ago

I'm not a US citizen, and I used to travel to the US from India occasionally before the pandemic. In reality there is no data that I have with me on my laptop or mobile device, that isn't already accessible to a nation state like the US. There is really no point trying to play games with US customs and immigration. You'll just irritate them and it won't end well.

The best strategy is to simply comply with all relevant US law and orders issued by officials at the border. And one should understand that at the border, a foreigner such as me will have very limited protections. In practice there are really no protections at all. People like me essentially rely on the goodwill of the US officials at the border.

For the most part they are polite and business-like. Its best to keep all interactions with them on a cordial basis and cooperate immediately and completely when ordered.

AsyncAwait4• 6 years ago

The best strategy is to simply comply with all relevant US law and orders issued by officials at the border.

The best strategy is not to travel to the US at all, if you can avoid it.

It's not even about not handing over data that they could have if they really wanted it. It's about sending a message that this behavior isn't OK and that foreigners are human beings too.

The US doesn't care about your privacy, but it does care about its economy and so voting with your wallet is still the most power you have. Continuing to degrade yourself at the border at their whims condones their abuses, however implicitly.

samatman4• 6 years ago

Every border on Earth already reserves the right to search your personal effects as thoroughly as they please, without any concept of probable cause being applicable.

If they don't extend that into data located on devices you're carrying across the border, it isn't because they don't reserve the right, but merely because they lack the means or interest.

hcnews4• 6 years ago

This is categorically false and borders on misinformation.

Subpeonas etc. can be challenged by US companies/individuals in the court when they are within the country. Innocent until proven guilty is the way of life within a country. During border crossing, system has been changed to assume guilty until proven innocent (for better or worse).

You are correct that if you are in such a situation (border agent asking for data), it's better to comply amicably. I personally would consider cloud backing data and cleaning up local drive before entering US as my best strategy. Carrying unsurmountable amount of data (10 TB+) is also another strategy.

mattlondon• 6 years ago

Likewise here from the UK. Be polite and respectful and generally I've never had any issues.

Once I even had the guard - who before me had been dealing with a plane full of Chinese tourists - give me a knowing smile and a "I can tell you know what you're doing" kinda comment as he more or less waived me through. I guess being a white male native-english speaker helps a lot in those scenarios.

P.S. Global entry helps a lot in these scenarios and is (still? was?) available to non-US citizens

submeta2• 6 years ago

When I was a kid in the 80s, I had a US flag on my wall. What happened to the US in the past fourty years? It became a country that I don't really want to visit anymore. Every civilized nation behaves differently, at least towards citizens of allied nations. We are no enemies. Ain't no reason to treat us non-US citizens like people without any rights. - I am deeply saddened to see the US come this way, and I have no hopes that this will change in the forseeable future.

Edit: Look at how non-US citizens exchange ideas for how to avoid handing over all their personal data at border-crossing. What a shame.

myaltacct415• 6 years ago

My simple answer: we became afraid. 9/11 showed us we were not invincible. Technology to enable mass surveillance had quick answers for our collective fears. Stoking our fears is a profitable industry. Here we are today.

submeta2• 6 years ago

I can totally understand the need to protect your citizens, but I rather think that this kind of behaviour damages the reputation of the US deeply. In the long run, you might have gotten your hands on someone's data that would like to harm the US (but are these guys so stupid to put their malicious plans on a handheld device they use at border crossing?)

Actually after the Snowden revelations: aren't the three letter agencies able to access our data without us knowing it anyways? If we are on their radar, they can get whatever info they want from us anyway. That's my understanding. So why harrass the normal person crossing the border?

save_ferris3• 6 years ago

Don’t know why you’re getting so many downvotes. This is pretty general but there’s a lot of truth to it.

9/11 ushered in an era where the US government took pretty extraordinary steps to protect national security by undermining the rights of citizens (see operation “Stellar Wind”.) It was so aggressive that FBI director Comey did not want to reauthorize it due to constitutional concerns.

Fear indeed is a powerful and profitable emotion to traffic in, it drives so much of our current media and political landscape.

A prominent political pundit that shall remain nameless said relatively recently that what is true doesn’t matter as much as what feels true. And that mentality dominates our political discourse.

coronadisaster3• 6 years ago

But Americans were controlled using fear even before 9/11.

NotSammyHagar5• 6 years ago

It's another thing where people have such a different world view about this that I can't understand why they don't have concerns. I can only guess people comfortable with this don't live in a place where the border patrol doesn't bug them, or they don't cross the border much. Your whole life is basically accessible on your phone, giving a copy of it to the us govt isn't going to make america a better country. I haven't ever understood what happens if you don't unlock your devices and just give them to them. Will they return them? I'm certain they'll harass you next time you come to the border.

Like a lot of things that come down to "this doesn't affect them", this is yet another issue where I'm surprised that there are people who support this. The border patrol is under the control of the president, who can make changes. They could change this policy. Obama didn't change it, and Trump doesn't seem likely to care, because 'it won't apply to him'. But why not? The 100 mile border plus other exemptions is incre

BoorishBears3• 6 years ago

Every civilized nation behaves differently, at least towards citizens of allied nations.

You're definitely free to think that...

Five Eyes and the customer lists for companies like Cellebrite definitely tell a different story.

Americans seem to make more noise about it for sure, there are more people willing to loudly oppose these kinds of things

UK: https://www.theverge.com/2013/7/15/4524208/uk-border-police-...

Australia: https://www.theguardian.com/world/2018/aug/25/sydney-airport...

Canada: http://www.theverge.com/2015/3/6/8162337/iphone-unlock-borde...

And there's others, Israel, German's BND literally handing over most of Europe's internet traffic to the NSA...

The same reason you as a non-American had that flag on your wall, is why you hear so much about the US. I'm an immigrant to this country and have lived in plenty of other places

Over the years people's opinions of the US in other countries have gone from overly positive compared to reality, to overly negative compared to reality, mostly because of the amount of scrutiny the country gets (and how much the media here thrives on turmoil, no one is quicker to insult America than Americans)

maxerickson2• 6 years ago

If it makes you feel any better, we don't treat citizens very well on the whole either.

I haven't had particularly bad experiences reentering the country, but they've been worse than the experiences I had entering other countries.

BoorishBears3• 6 years ago

You know, when you try and compare the US to any country doing worse than the US at treating it's citizens...

... you usually instead get called out for not comparing the US to some homogeneous Scandinavian country that would fit inside California.

Neither is a realistic comparison, in general governments will quickly default to not treating individuals well because of the dehumanizing tendencies of bureaucracy and power dynamics, and the effect is only amplified "few party system" most countries end up with.

The US struggles, but does make excellent progress, in escaping that trap.

I'm an immigrant to this country, my pride doesn't rest on "USA #1!!!!!!!"-style nationalism...

But the US treats it's citizens great on the global scale of the term, that's why they're so quick to make noise when certain groups are excluded from that fair treatment.

The fact Americans are so comfortable and so quick to self-denigrating is just a further reflection of that.

dredmorbius• 6 years ago

The trend unfortunately dates back through history. The 1960s through 1990s were a high period of openness to foreigners and globalisation, across the political spectrum, though not universally embraced. In particular the 1965 Hart-Celler Act, lifting nation-of-origin quotas (https://en.wikipedia.org/wiki/Immigration_and_Nationality_Ac...) and the 1961 formation of the Peace Corps (https://en.wikipedia.org/wiki/Peace_Corps) saw a tremendous increase in non-European immigration and foreign students to the US, and of peaceful deployment of Americans to non-European nations. (Despite overlapping in part with the Vietnam War). Globalisation, beginning in large part with oil and the Middle East but extending to consumer, manufacturing, and service relationships, also played a major role. The "bad foreigners" existed, but were Communists, a relationship that shifted and softened beginning in the 1980s, with Islamic and generally Latin-American narcotics adversaries ascendant.

Richard J. Hofstadter, "The Paranoid Style in American Politics", is a 1963 essay that "explores the influence of a particular 'style' of conspiracy theory and "movements of suspicious discontent" throughout American history." It's not specifically concerned with anti-foreign sentiment, but includes that.

https://harpers.org/archive/1964/11/the-paranoid-style-in-am...

https://en.wikipedia.org/wiki/The_Paranoid_Style_in_American...

But the xenophobic pattern is clear in the history of American Immigration law. Forced Mexican Repatriation (1932), The National Origins Formula (1924), California Alien Land Law of 1913, Anarchist Exclusion Act (1901), Chinese Exclusion Act (1882).

The Page Act (1875) barring "immigrants considered 'undesirable,' defining this as a person from East Asia who was coming to the United States to be a forced laborer, any East Asian woman who would engage in prostitution, and all people considered to be convicts in their own country."

https://en.wikipedia.org/wiki/History_of_laws_concerning_imm...

Samuel Finley Breese Morse, creator of the eponymous Morse Code, wrote an anti-immigrant, anti-Catholic screed, Foreign Conspiracy Against the Liberties of the United States, initially anonymously though his name was later associated with the piece.

Surely American Protestants, freemen, have discernment enough to discover beneath them the cloven foot of this subtle foreign heresy. They will see that Popery is now, what it has ever been, a system of the darkest political intrigue and despotism, cloaking itself to avoid attack under the sacred name of religion. They will be deeply impressed with the truth, that Popery is a political as well as a religious system; that in this respect it differs totally from all other sects, from all other forms of religion in the country.

https://en.wikipedia.org/wiki/Samuel_Morse#Anti-Catholic

https://archive.org/details/foreignconspiracy00mors

That itself is only one of a long line of examples of anti-immigrant, nationalistic, or racist sentiments expressed by business and industry leaders, including notably Henry Ford and Thomas Watson (IBM), both anti-semites and Nazi collaborators.

https://www.thehenryford.org/collections-and-research/digita...

https://allthatsinteresting.com/henry-ford-nazi

https://www.algemeiner.com/2012/04/12/ibms-role-in-the-holoc...

Mark Twain's On the Damned Human Race includes numerous essays highlighting abominable treatment of and policy toward foreigners (and others), notably during the Spanish American war, mostly dating from 1890-1910.

https://www.worldcat.org/title/mark-twain-on-the-damned-huma...

Ellsworth and Harris, The American Right Wing (1960) is a fascinating look at reactionary politics, much of it xenophobic and racist, largely of the 1940s and 1950s, with more than a few names familiar today.

https://archive.org/details/AmericanRightWingEllsworthHarris...

True history is far darker than the highlight reels.

DanielBMarkham• 6 years ago

Healthy systems exist in multiple-layered robust feedback systems. Short answer: we're the same people just as afraid as we've always been, but we've dismantled or disabled several different feedback systems. We kept mucking with a complex system until we broke it.

This news is a horrible thing, and I'm outraged. It needs to be fixed. Right now. Having said that, it's good to have a little bit of historical context. Every governmental structure we've set up, from the military to a national police force, has pushed the limits to see how far they can go.

You think you'd set up these agencies with clear missions and they would stay inside the coloring book and mind their knitting, but that's not how it actually plays out. Instead, egotistical, ambitious people get in charge and want to do something even more impressive than the last guy. That means pushing things. IIRC, one of the first uses of a telephone tap was made by law enforcement. The intelligence community got so far out of whack that by the 70s it took a major reform to try to un-screw them. A lot of that work we dismantled after 9-11.

Here's another way of saying the same thing: it used to be that when extreme things happened the people we elect and the government we've created took drastic, emergency and probably extra-constitutional action to react. You can go back as far as Jefferson (or before) and the Louisiana Purchase and see people we put in charge kind of making it up as they went along.

This actually worked well because if there was a mistake? Well, we were doing it the wrong way to begin with. Elect new people, clean up the agency, say a bunch of apologies and write checks, and don't do that again --- at least in the same way.

Now, however, we want to create systems of things. Whereas it used to be that if they thought there was a bomb on a plane they might forceably unload it and strip-search everybody there, now we just hired tens of thousands of people and treat everybody that flies like a potential terrorist. Problem solved. No more worrying about those one-of incidents. No more people getting fired, agencies looking bad, or any of those huge cleanups.

After the 93 World Trade Center bombings, the United States Secret Service wanted to put anti-aircraft missiles on the White House. They were laughed out of the room. Who knows, they might have put some up anyway and nobody ever found out. After 9-11 that changed. Now it's a system. They wanted to shut down Pa Avenue, also laughed out of the room. They got it. They regularly ruin cell service, and are monitoring all calls in the area. Now they're bulk-buying privacy data and asking for even more permissions. These aren't "Hey, we're worried that something might happen, so let's try this for a while even if it's wrong" These are "We want permission to do this from this point on out and you leave us the hell alone" I don't mean to pick on them. Everybody's getting in on the action.

I could continue the rant, but as you see, this isn't a case of people changing or agencies changing in the last 20 years or so. This is a case of continuing to tinker with a system over 230+ years until you broke it. I wish it were just as easy as blaming the Border Patrol. It is not.

aboringusername2• 6 years ago

The easiest thing to do is to simply not take electronic devices with you anywhere in the world, otherwise there is a slight risk of someone wanting to understand the information contained within it.

If you think there is a risk, and you take a device, obviously FDE is a requirement, although, that could be seen as "suspicious".

The easiest thing to do is to fill up TB's of HDD's with useless information. Random pictures, documents, perhaps thousands of people's contact information downloaded from a public source. Store any "important" documents as random file names, perhaps inside archives or volumes that need decrypting. Or not at all, instead "in the cloud" but still encrypted so that you can travel without worrying about somebody accessing your information. Make deliberate "suspicious" file names, make them believe a file is encrypted (a 50GB file named "totally not a hidden volume.hiddenvolume") and maybe they will waste time trying to open the volume only to realize it contains thousands of pictures of naked molerats.

Clearly you need to be smart about crossing borders with electronic information these days, and not having any with you seems to be the best course of action.

stjohnswarts• 6 years ago

This why you keep the stuff you can't show people in the cloud encrypted with a password only you know. Once you get to the border you can't really argue any longer. That said, the US really needs a new amendment spelling out digital freedom and privacy rights. The old farts in Congress don't see information on devices as information portrayed in the constitution. Information is information and the Constitution laid out methods for handling it long ago that are far superior to what our current idiots in charge seem to be able to handle. About the only ones we have paritally on our side are judges who actually know the constitution rather than pay it lip service; those types are also becoming rare.

ianleeclark2• 6 years ago

The easiest thing to do is to simply not take electronic devices with you anywhere in the world, otherwise there is a slight risk of someone wanting to understand the information contained within it.

I think people seriously misunderstand the range that the Border Patrol has--its far more than the US and Canadian borders. Portland Oregon, for example, is within their grasps due to the coast + 100 miles being considered part of the border.

So, you could be never leave the country and be caught up in their web quite easily. I wouldn't be surprised if 70% of the population of the US lived within their range.

bcrosby95• 6 years ago

I've always wondered - why is this border considered to be at the coast, rather than at the start of international waters?

chrisshroba• 6 years ago

Genuinely curious - what would be an example of how border patrol might exert influence over someone not crossing international boundaries? For example, if I live in an apartment in Portland, under what circumstances might USBP decide to search my computers/phone/etc.?

Pyxl101• 6 years ago

Full disk encryption isn't suspicious. It's standard on many corporate devices, and corporate travelers cross the border with them constantly.

However, the encryption would not protect you against this problem. They may ask for the password to decrypt the volume and deny you entry to the country if you refuse to provide it.

standardUser2• 6 years ago

"The easiest thing to do is to simply not take electronic devices with you anywhere in the world"

That sounds monumentally complicated and not easy at all. I understand that a tiny percentage of highly engaged techies can manage what you are talking about, but 99% of people cannot.

sys_64738• 6 years ago

Surely you'd need to be a person of interest to have them process your data. The data is likely encrypted so how do they decrypt it? They can socially engineer a way in but does that work? Do people break down and give up their passcode?

Would they really process the data just because? It seems like a severe amount of data to process and evaluate. How much compute power is set aside for this and how much online storage is used? Do they use a cloud service for this?

It'd be interesting to hear from somebody in the know about what is they real can do and what is heresy.

aboringusername2• 6 years ago

To be honest, if your decryption process is "just" a passcode you "know" then you've already failed.

You could have a key and a passcode that relies on 10 steps (such as using a web service) that is reliable for you to know but not easy to "explain" how to obtain (and, as a bonus, easy enough to build in a dead man's switch, if I don't visit script.php within 24 hours the key is gone and even I can't decrypt now).

LeifCarrotson• 6 years ago

In the past, a human was required for most policing operations. Economically, that meant you'd need to be a person of interest or at least incidentally connected to one to be subject to an investigation. It meant that judges and legislators could say stuff like "it's fine for the police to run arbitrarily license plates, that's public information" because running license plates meant there was a cop with a pad of paper walking through a parking lot, bringing the notes back to a clerk to manually tab through the registration files. Storing the data and processing it used to happen at human speed and cost on the order of $20/hr, assuming they weren't working overtime rates on nights, weekends, and holidays, now it runs at gigabits per second and costs $0.05/hr to run 24/7.

I'm not in the know, but I know that all the email content I've ever written is trivial to fit on a $50 hard drive, and with that I can search through 20 years in under 20 seconds.

It's not a question of "could they do it" but "would they do it", your answer to that question depends on social and political issues, not technology. It's why I prefer technical solutions like encryption to political problems like privacy.

Shared4048• 6 years ago

They can socially engineer a way in but does that work? Do people break down and give up their passcode?

https://xkcd.com/538/

The border patrol isn't really known for it's humanitarian works.

mlthoughts20184• 6 years ago

I wonder what implications this would have for business travel. Devices may be required to be encrypted and giving a business password may violate employment law in the home country for non US travelers. It could be illegal to grant US border agents access to the phone and also illegal not to.

Even if you could grant access, businesses may very rightly feel the content shouldn’t be accessed by US border agents and if it’s stored by border agents, it means now some US government server could fall under the juris diction of GDPR or something (eg my work phone or laptop had a photo with sensitive customer data or something).

On top of that, it’s increasingly mandatory to use your personal phone for business data, eg PagerDuty, Slack, company email, company social media tools. So while it may be your personal device, you may still run into crazy conflicting issues of whether you are allowed to unlock it.

How are you going to comply with “delete my account” requests when some business data is on US government servers for 75 years?

US agencies have deeply poor and incompetent information security, so how long before this is subject to a data breach, or a rogue employee exfiltrating and selling it? Will people be able to sue the US government for substantial per-person damages when that happens?

The conflicting and incompatible privacy issues of this are bananas. What an arrogant and deeply stupid thing to do by the border agency.

coronadisaster3• 6 years ago

Businesses are first class citizens, unlike real people, so you should be ok.

walterbell• 6 years ago

Some businesses don't allow their corporate data to cross borders via devices, e.g. they can use VDI to keep all data under enterprise control except for pixel-level viewing.

supernova87a• 6 years ago

I guess the studios wanted to get their copyrights extended one way or the other.

dbg31415• 6 years ago

I'm going to start traveling with a 10 TB Encrypted NAS full of static. They can download that and save it if they want.

What sucks is that I know this is probably being stored on AWS. Tech companies enable this kind of shit, and even push sale of larger and larger systems to governments. And they are massively rewarded for doing so.

This isn't the government... this is a sales guy at AWS pushing them to store things for 75 years... he knows he gets a helluva commission check on that deal.

Gross oversimplification, but not really. We, as technologists, have to take responsibility here.

pseudosavant• 6 years ago

Remind me to travel with terabytes of encrypted garbage data. Just to be a costly pain in the ass. I'd love to watch an incompetent CBP agent try to figure out how to move 10TB of disk images with USB thumbdrives.

gruez7• 6 years ago

Your time is probably a bigger issue. Hard drives maybe average 200MB/s transfer speed, so a 10TB disk would take a little under 14 hours to image. I don't know about you, but I'm not too inclined to waste a day just to troll the CBP.

kardos• 6 years ago

Being detained and missing your plane while they do that in a slow bumbling fashion will be less lovely

swyx• 6 years ago

a federal judge in Boston ruled that forensic searches of cell phones require at least reasonable suspicion “that the devices contain contraband.”

outside of illegal porn, what exactly constitutes digital contraband? is this defined anywhere? any well known example cases?

klyrs• 6 years ago

If you hack somebody and steal their data, that'd probably count. If you've exfiltrated confidential data from your employer, that could count. For a time, exporting strong crypto was illegal; we might see a return to that.

TrackerFF• 6 years ago

industrial and state espionage?

Surely if you're traveling with illegally obtained classified information, that's seen as contraband.

biddlesby• 6 years ago

Is there a list online somewhere of all the crazy shit that can legally happen to you in the US? How long you can be detained for, what data can be extracted from you, and so on? Like if you had a really bad day and the authorities exercised all of the powers over you they legally have.

tmpz22• 6 years ago

They can put a knee on your neck for seven minutes and 43 seconds until you are dead and be home watching TV The next day.

StartupTree8• 6 years ago

I thought that cop was charged with murder? I must have got confused, thanks for updating me.

dTal2• 6 years ago

The symbolic time is 8 minutes and 46 seconds. The actual time was 9 and a half minutes:

https://en.wikipedia.org/wiki/Eight_minutes_46_seconds

StartupTree8• 6 years ago

Just wait until you hear about every other country on earth...

Shared4048• 6 years ago

Pretty sure this is called whataboutism.

Just because some other places are worse

A) Doesn't mean some are better in this regard.

B) Doesn't mean we shouldn't try to make it better here.

tgsovlerkhgsel2• 6 years ago

They can accuse any and all property you bring with you of a crime and keep it, with very limited recourse for you.

arkanciscan2• 6 years ago

My takeaway; they have to search for porn first because they can't be amassing a huge porn collection, so store your sensitive info in your porn folder!

est31• 6 years ago

Information is stored for 75 years although if it’s not related to any crime it may be deleted after 20 years.

I wonder if you have your house burned down and you want your digital pictures back, can you ask them to give you a copy of their backups? That's the only thing that storing this data for this period of time is useful for, but I guess they won't hand it over.

neltnerb2• 6 years ago

It may still be useful to the endless parade of hackers that get access to the confidential documents "procured" by CBP in this way and stored in what I sincerely doubt will be some impenetrable database.

Not to mention that given their track record regarding things like facial recognition software, individual unmonitored CBP agents will probably be able to just you know, steal all the private information taken on people they're stalking.

The police have already been caught abusing these databases when they were minimal, increasing the amount of available stored is idiotic until we solve the problem of oversight and security.

OminousWeapons2• 6 years ago

I believe someone awhile back tried to compel the NSA to release data collected in mass surveillance which he claimed could exonerate him. Unsurprisingly, this tactic did not work.

monkin• 6 years ago

At least now I can be like Jason Bourne, and have lockers in different parts of the world with laptops and phones... ;)

JumpCrisscross• 6 years ago

Before uploading it to their network they check to make sure there’s no porn on it

What happens if there’s porn?

coleifer• 6 years ago

What are the use-cases, and when would such a policy have led to a drastically different outcome (in the case of a crime being committed, industrial espionage, or what-have-you)?

If I have a laptop encrypted with luks or whatever, then what? What are the consequences of non-compliance?

Shared4048• 6 years ago

Not sure why this got killed. I would like to have the answers to these questions myself.

modzu• 6 years ago

defund the border patrol. seriously

sixhobbits• 6 years ago

The interesting thing about this is that it affects people who have never been to the US and never intend to go, or those who do but take 'precautions' to protect their privacy (secondary devices, double encryption etc) as most of the data in anyone's inbox is not generated by them.

That's pretty scary.

Joeri• 6 years ago

It also affects U.S. citizens who don’t even have a valid passport and no intention to leave the country. According to the CBP being in the extended border zone is enough to be crossing a border and therefore be subject to a warrantless search.

icodestuff• 6 years ago

Before uploading it to their network they check to make sure there’s no porn on it (so they search your devices to find porn first).

"Stenographically encode your important documents into your porn" is what I'm reading here.

hansvm• 6 years ago

It sounds like a person needs a filesystem that generates a few exabytes of GPT-2 output on the fly.

WarOnPrivacy2• 6 years ago

I hate the world in which my own Gov is the nation state I need to fear.

WarOnPrivacy2• 6 years ago

What's super awesome is nearly every US voter (including the ones reading this) will vote for the jackwads that enable and fund bulk surveillance abuses like this.

In and outside the US, non US citizens serve as a proving ground, for tech that US Gov will eventually deploy against it's own citizens.

US Gov does this because it can, because news orgs are more interested in sportball, because both parties have successfully set citizens at each other throats for decades and because the public keeps gorging on whatever fear-filled plate of nonsense is put in front of us.

Ten years from now, an entirely new regime of surveillance abuses will be added to those already deployed against us. More than any other reason, this will happen because we endlessly reelect the people who are ultimately responsible.

We could do better.

stallmanite2• 6 years ago

I 100% agree with you. What can a voter do until the EFF fields a candidate? There are copyright and surveillance maximalists running both parties apparently. The DMCA, the Patriot Act, and the all the other BS seems to the type of stuff that everyone in power agrees on and no candidate that I’m aware of is trying to do anything about it.

hatenberg• 6 years ago

Cue the inevitable breach.

Havoc• 6 years ago

How long till burner devices are necessary for traveling to the US?

Yc4win• 6 years ago

I know they market this product for security researchers, and I've read all sorts of good reviews about the "anonymous" version. May everyone expand on this concept:

https://usbkill.com

yosito• 6 years ago

It would be interesting to have one of those built into a smartphone as an antitheft device. It could thwart someone who steals your phone or otherwise tries to get unauthorized access. Does anyone know the legal status of setting traps for intruders into private property?

US Border Patrol says they can create central repository of traveler emails

Related Stories