The New York Times had a front-page article today: Traveling Light in a Time of Digital Thievery, aka "Electronic Security a Worry in an Age of Digital Espionage".
Former director of US national intelligence Mike McConnell is quoted as saying
“In looking at computer systems of consequence — in government, Congress, at the Department of Defense, aerospace, companies with valuable trade secrets — we’ve not examined one yet that has not been infected by an advanced persistent threat.”
It notes that many high-profile organizations require their employees to take extensive precautions when traveling to China, Russia and other countries that have been implicated in advanced attacks. That includes, e.g.:
- traveling with "loaner devices" which are wiped pre- and post- travel, rather than their own cell phones or laptops
- disabling Bluetooth and Wi-Fi
- never typing a password
- and, in meetings, not just powering off devices, but removing batteries "for fear the microphone could be turned on remotely"
It seems that using encryption might be problematic:
Both China and Russia prohibit travelers from entering the country with encrypted devices unless they have government permission.
and also notes that
When officials from those countries visit the United States, they take extra precautions to prevent the hacking of their portable devices, according to security experts.
Do these precautions make sense for people with access to info they consider highly sensitive? (Even the bit about removing batteries?) What else might people do?
Which countries have this sort of capability?
Of course I know that good answers require more careful analysis of the traveler's security requirements, plans while traveling, etc. etc. But a list of precautions to consider would still be helpful.