104

Since laptop and other electronic device seizures at US borders became legal without a warrant (including making copies of data), 7% of ACTE's business travelers reported being subject to a seizure as far back as February 2008.

What measures have IT departments taken since to protect sensitive corporate data, and are there any estimates of their (aggregate or individual) costs? I've only found this article about the economic costs of laptop seizure, but no figures are mentioned.

  • 36
    I would trash any hardware they seize if i ever get it back...i'm going to say "no thank you" to spyware on my hardware – Freedo May 12 '15 at 0:15
  • 25
    What kind of mad world do we live in where forcing people to disclose their password is even vaguely considered ok... – Luke McGregor May 12 '15 at 22:32
  • 3
    I like the books of W. Gibson and other similar works, but would rather like they stay fiction. – Mindwin May 13 '15 at 15:49
  • 1
    Regarding the newly added cost estimation aspect, I am not sure there can be any general answer since it largely depends on the context. Some journalists and activists are brought to secondary inspection upon nearly each border crossings, while "uninteresting" travelers may go through their whole life without ever being asked any question. It is clear that the costs in these two situations are at two extremes... – WhiteWinterWolf May 14 '15 at 9:40
  • 1
    @robertgrant they don't have a warrant, or any reasonable cause that's part of what makes it so bad, also what could you possibly be bringing into the country you couldn't do completely anonymously via the internet? It's like the government randomly picking houses to break down the doors. – Luke McGregor May 18 '15 at 12:25

10 Answers 10

83

The ANSSI, French government service in charge of IT security, has published a document providing brief advice to people having to travel abroad.

Relevant here are the advisories concerning preparation before travel:

  1. Review the applicable company policy,
  2. Review destination country applicable laws,
  3. Prefer to use devices dedicated to travel (computers, smartphones, external storage etc.) and not containing any data not strictly needed for the mission,
  4. Backup all of your data before leaving and keep the backup in a safe place,
  5. Avoid taking any sensitive data at all, prefer to use a VPN (or a specially set up secured mailbox where all data will be deleted after retrieval) to retrieve the data securely (this is one of the most on-topic pieces of advice, since this one prevents any sensitive data from being present on the computer when crossing the border),
  6. Use a screen filter to avoid shoulder surfing during travel,
  7. Apply a distinctive sign on the computer and accessories (like a sticker, do not forget to put one on the computer bag) to facilitate tracking and avoid any accidental exchange.

The linked document then goes on with other advice concerning the rest of the trip but this is less relevant regarding the current topic. Sorry to provide French documents as a source, but the ANSSI is an authoritative source in France and I felt it could be a worthy addition to this discussion since these advisories seem to properly address the question.

Edit:

As some comments and the very useful answer from Spehro Pefhany below pointed out, there are two other things which should be noted:

  • If your computer is seized, if you are requested ciphering keys and password, do not put up any resistance since it may lead you into legal trouble (I suppose you are traveling with some sort of mission, it would be too bad for the mission to be canceled because you were not in measure to attend the meeting or respect some contractual engagements. Customs may have plenty of time, you may not.) However, immediately inform your company IT staff and managers so due actions can be taken (revoking corresponding accesses, passwords, certificates, etc.) and discuss the issue with them to determine the way to proceed since the seized then returned devices may not be trustable anymore (impact and mitigation directly depends on the nature of the mission).
  • Customs are a two way passage. When preparing your luggage for the return travel, ensure that you have properly cleaned up you devices (again, not only the laptop: all devices including cellphones, external storage, etc.): send your data to your company (in a ciphered form, again either using a VPN or a secured one-time email account) then wipe the files using appropriate software, delete browser's history/cache/cookies, delete OS temporary files, delete call, messages and voicemail history, delete information about used networks (Wifi accesses, proxies, etc.).

And while I'm at it, good advice for the traveler:

  • Be careful when you are offered any external media like a USB key or a CD. Be careful too when exchanging documents with other people using writeable external media (as a reminder, the write protection on SD-cards is software only and therefore cannot be trusted),
  • Do not plug your cellphone into the free public USB chargers, which are becoming more and more frequent in places like airports,
  • No matter if your devices have been seized or not, do not plug them back on your company network unless they got at the very least a thorough check.
  • At your return change all passwords which were used during your travel.
  • 16
    This is the best practical answer. Let them search your freshly-reimaged laptop. If you prevent them searching your laptop, and they notice, they can bar you from the country. Or in some cases deport you to the wrong place! – pjc50 May 11 '15 at 10:10
  • 9
    3 and 5 are particularly important. Attempting to hide or encrypt all your sensitive data just makes you look more suspicious. If you have a company laptop full of sensitive data, leave it at home. Take a "disposable" laptop with nothing but COTS/OSS software on it, and no sensitive documents at all. Arrange for documents to be delivered by another means. – Simon B May 11 '15 at 11:14
  • 18
    I'm the only one actually far more concerned of the security of my hardware after i get it back than having they scanning it on first place? What if they flash a malware on BIOS or put hardware spyware on it? Your sensitive data would be stolen as soon as you download it – Freedo May 12 '15 at 0:02
  • 5
    It should be safe to connect a cellphone or other device to a USB charger at an airport (or other public location) with a power-only cable (one that is missing the data wires). – Nathan Osman May 13 '15 at 18:02
  • 4
    @NathanOsman: Often such cables will result in non-charging or extremely slow charging because negotiation via the data cables is needed in order for the device to be allowed to draw greater than a tiny current over USB. Getting both protection and usable charging requires a proxy device that negotiates the current but does not allow arbitrary data over the wire. – R.. May 14 '15 at 17:54
19

A useful and practical guide to securing information devices when crossing borders is provided by the Canadian Bar Association here. I would not say the U.S. border is the only one of concern, others such as China might eventually become similarly aggressive (though I've seen little sign of that to date).

The guide echos many of the points made in other answers (avoid having anything sensitive on the machine at all if unnecessary (preferably keep your travel computer forensically clean), do not make it any easier than necessary for the drive to be imaged, consider encryption, back up data where you can get it so it doesn't impact your livelihood were the device to be confiscated for an unknown length of time).

One important point is that if you lose control of your device at a frontier checkpoint, you should treat it as infected with spyware from that point forward.

You should have a backup of your smartphone available (not necessarily with you). Smartphones can hold a wealth of information- it might be worth it for frequent travelers to have a separate cellphone of the same type as their main phone and transfer the SIM card between phones. By default your phone can show a nosy person all the places your phone has stopped in the last couple of weeks, on a map, and if your neighborhood cinema (say) happens to be next to something provocative, it could arouse unnecessary suspicion.

Of course this applies to ordinary folk engaged in sensitive (perhaps unpopular or commercially valuable) but legal activities. If you're actually doing genuinely bad stuff this probably won't cut it (and that's fine).

It's also important to remember that your devices can be searched upon return to your home country. The mere presence of certain technical documents on your computer under the wrong circumstances can cause you to be at risk of many millions of dollars in fines and perhaps a decade behind bars because you would be deemed to have 'exported' them. The risk level probably goes up greatly if you have clearances that allow you to have privileged access to such documents and your itinerary looks odd-- to a border guard.

  • 6
    This is a really excellent point: "if you lose control of your device at a frontier checkpoint, you should treat it as infected with spyware from that point forward". I am not worried about permanent laptop seizure, just about anyone at border control messing with my laptop or devices. I don't worry about NSA spying on me as much as about careless security practices by border patrol staff. If they mess with something of mine, I can't be certain they don't inadvertently cause any number of issues. – Ellie Kesselman May 12 '15 at 19:24
18

The best way to protect against that type of border search is actually not to have anything suspicious on the hardware you take through the custom.

Using encryption technology will most likely raise suspicion in the first place. Refusing to provide the necessary codes can, in some places, leads to the hardware being confiscated or even to you being arrested. Of course, that is highly dependent on which border you're actually crossing: in some part of the world, you're more at risk from petty theft than from government-sanctionned casual spying.

For the US, the EFF has a nice article regarding this specific issue highlighting a number of practical way to reduce your exposure (removing the data drive, storing data on a networked server, using a "travel" laptop, etc.)

For other countries and legislation, it has a lot to do with the local laws (and practices) so some research is most likely necessary.

  • 12
    One of the more novel techniques I've heard about is people covering the screws on the reverse side of the laptop with glitter nail polish. When the polish is set they photography the unique pattern of dots created by the glitter suspended in the polish. It is highly unlikely (if not impossible) that anyone would be able to recreate that pattern after having moved the hard disk for cloning/analysis. – user56893 May 12 '15 at 21:46
  • 4
    @JamesR Here is an article about that nail polish treatment. – Dubu May 13 '15 at 9:06
  • 5
    A comment on "Using encryption technology will most likely raise suspicion in the first place"... may still be true for personal devices. However, full-disk encryption is pretty common for corporate-owned laptops (possibly with some key-escrow solution so that the corporate I.T. department can reset the password, but DHS won't have access to that). For example, all IBM employees who carry laptops use either PGP (Windows) or LUKS (Linux). And a corporate employee won't be fired for saying "only my employer's lawyer can tell you that password". – david May 13 '15 at 14:16
14

Full disk encryption is the most common one used. The cost would depend on the time which needs to be implemented by the IT department ontop of normal laptop staging. However in my experience FDE is a must for any organization taking its security serious.

Aside from that there are also some really anti-forensic tools, I remember a talk at Brucon where one of the speakers has had issues in regard to that and provided some tools to patch Truecrypt and have some anti-forensics.

Now in regard to situations where entry would be denied, you would have to rely on a risk assessment which is performed by your internal security office. They should define what should happen in such a case, which is either leave the US or surrender your keys.

Also note that recently U.S. District Judge Amy B. Jackson has issued the government a long overdue smack-down in this regard. While her ruling is based on the particularly egregious circumstances of this case (waiting for someone to leave in order to get around a warrant, seizing the laptop without searching it and transporting it to be imaged and forensically analyzed, the flimsy tip, and the lack of any allegation of a current crime), she resoundingly rejects CBP’s assertion that it needs no suspicion to do whatever it wants at the border regarding digital devices.

  • 12
    I've read that you FDE is ineffective because you can be denied entry if you refuse to provide the decription key. – Dan Dascalescu May 11 '15 at 7:25
  • 7
    @LucasKauffman Would violation of 5th amendment even apply to non-US citizens? – Hagen von Eitzen May 11 '15 at 11:37
  • 10
    The border admission process is not a legal proceeding. The 5th amendment therefore doesn't matter - self incrimination isn't applicable. – MSalters May 11 '15 at 12:13
  • 5
    @user3147268 I don't think the fact that the traveler doesn't know how to decrypt the data matters (especially as everyone can pretend that). If you must surrender the keys the best way is to not have any sensitive data and only download it via a secure channel once you passed the border (for authentication you can use a smartcard which is common enough to not raise any suspicions). – user42178 May 11 '15 at 14:23
  • 7
    If i used TrueCrypt, i would create a 1,339,036,935,291 byte file, with an innocuous name (e.g. twasnme - Star Trek_ The Next Generation.mkv). Inside that volume would be a hidden volume. That is what i would do if i used TrueCrypt. But i don't use TrueCrypt; and i definitely don't have a hidden volume anywhere. – Ian Boyd May 11 '15 at 18:51
13

I have two solutions. Both require Full Disk Encryption (FDE).

First Solution

Credit to Bruce Schneier.

  1. Just before leaving home, create a second key. Type it with your forehead, a cat or dog, just so it's random and not possible to remember.
  2. Send the second key to a trusted person, preferably someone with a privileged relationship, i.e. lawyer, priest/preacher (get your IT guys ordained over the internet, Instant Privilege!), and test to make sure it works.
  3. Shred or destroy all copies of the new key.
  4. Be productive on the flight home, then delete the key you normally use.

--Don't lie to customs, it may be a crime in many places. Even show them this article.

--Explain that they can confiscate and/or copy the laptop, but they will have to go through the courts to be able to see the data. Only explain the last part if you have to. Don't be a dick.

  1. After customs, get your random key back, add usual key.

Second Solution

With FDE, send non-memorizable keyfile to your destination also send or keep a copy with a trusted person.

Or Ship laptop and keep decryption keyfile on a tiny USB drive. keep it in your carry-on or, if you're paranoid, in one of many skin folds or orifices.

  • 7
    Your "priest" has better to know GPG for this solution to be trustable. Indeed, if you are willing to apply this procedure, it means you carry valuable data. If you send the password by email to the priest, then you can assume that the NSA has access to the email content. With the customs making a copy of the hard disk content, they have all that is needed to decipher it without your help. – WhiteWinterWolf May 12 '15 at 12:57
  • 3
    It doesn't mean the person is carrying valuable data. It could mean they don't want their device messed with, and/or just abhor the power grab of computer searches at customs. It could even become a grass roots practice to always have a friend change to an unknown password before going through customs. Or even to bring a device (or several) full of pointless decryption puzzles but no useful data through customs on every trip. – Dronz May 12 '15 at 19:03
  • @WhiteWinterWolf Sending the key could be by carrier pigeon, RTTY on 40 meter radio, or GPG encrypted email. All of my work email is encrypted, and all of it is pretty boring. If the NSA asked me nicely, I would even show them. If they were really interested, I'm sure they already know. Dronz, Exactly, value is relative. Aztech Group just paid Millions for a pork recipe. I use GPG to trade worthless, but yummy, fish recipes with my brother. I send text messages—encrypted, not because, “Dude, I'm on my way.” is valuable, but because my privacy is. I even use Tor to check the weather. – Someone.Else May 16 '15 at 16:06
4

The most efficient approach I can imagine is the following:

  • Boot from a USB media
  • Mount a hidden encrypted volume located on internal media
  • Leave boot media at home
  • Use a screen saver which upon seeing a secondary password will cause a system crash.
  • Have a bootable system on the internal media using the secondary password as login password.

There is a few caveats to this approach. First of all, if you run out of battery, all data on the laptop will be inaccessible until you can get a new boot media. If the system on the internal media is ever booted, it may overwrite some of the encrypted data, so in that case you would need to consider your encrypted image lost.

The data loss in that case is no worse than in case the laptop is stolen. And the protection you need in both cases will be the same, you need to have a backup of your data in a secure location.

Additionally, you need to be aware that some (maybe all) storage encryption implementations have a weakness in that the key and some confidential data remains in RAM while suspended. For security upon suspend the key should be wiped from RAM after all other data in RAM has been encrypted. It needs to be such that upon waking from suspend the only thing the machine can do is to accept a screen saver unlock password, which will decrypt the RAM, or it can accept the secondary password causing a crash. (Some of the implementation details can be varied about from what I sketched here, and still remain secure.)

Hibernation is less secure, because you don't want to leave data on the internal media, which gives away the existence of the above constructions.

  • Why do you need to force a crash? Why not just reboot into the clean OS before going through security? – Mike Ounsworth May 11 '15 at 13:23
  • @MikeOunsworth Because in the scenario I describe, booting the OS from the internal media would cause the encrypted image to be damaged. Moreover simply shutting down the machine would mean the encrypted image would be inaccessible until you have the boot media again. The point being that there would be nothing giving away the presence of the encrypted data once the machine had been shut down, but that would also mean you wouldn't be able to decrypt it. – kasperd May 11 '15 at 13:30
  • 1
    ....while I agree that's certainly secure, I'm skeptical that it's the most efficient. – Mike Ounsworth May 11 '15 at 13:37
  • 1
    @MikeOunsworth Most efficient efficient at hiding the presence of any encrypted data. If they cannot see that there is any encrypted data on the laptop, they won't be asking for the decryption key. I'm not saying there isn't any more efficient solution, I'm just saying, I don't know what it would be. – kasperd May 11 '15 at 13:51
3

Full-disk encryption, three-level.

First level: secure boot to the OS. Normal counter-measures (two flash drives/CD for bootloader signature verification, USB-AES passthrough devices and TPM/UEFI signing where applicable).

Second level: inner container with data - split it into two parts (each 128 KB of disk space, eject 1 KB of data to remote storage).

Third level: transfer the rights to access/deny the data to a third party. In a form of "I must ask unaffiliated person from non-US jurisdiction to either receive secure data or get it deleted".

So: officials can't access your data or apply legal measures to you (because technically the key is outside of their or your reach); your data is secured.

1

In many places I've been in departments typically have "travel laptops". These are blank laptops with standard corporate encryption, office, a web browser (for email access) and that's it nothing else! No access to corporate networks, no access to personal disk areas nout!

These laptops were used whenever an employee left the country regardless of where they were going. The employee could simply load the laptop up with powerpoints / necessary documents go to their meeting and upon their return the laptop is re-imaged and is fresh again. I'm not sure the policy took into account forensic examination but in terms of sheer damage limitation it seems to work quite well.

0

This works as a security for all types of communication. It's also a kind of security by obscurity.

Simply insert a number of keywords into any document / communication: Terror threat. Bomb. Nuclear. Royal family.

Selection of current time important individuals by name ~ presidents, prime minsisters, etc. Do the same for events ~ Olympics, World Cup, etc.

The poor security services will be so busy trying to find the real useful information from the polluting rubbish they will never have time to do anything else.

Downside to this: Everyone needs to do it for it to be truly effective. Actual criminal activities will get lost in all the noise, which is probably not helpful.

  • 1
    This idea reminds me of the Jam Echelon Day, a day during which all people around the Earth were encouraged to put specific keywords in all of their mail, phone, fax and so on communication in order to overflow the NSA's Echelon monitoring system... – WhiteWinterWolf May 14 '15 at 12:13
  • @WhiteWinterWolf OK cool. Never heard of that but seems like the easiest thing to implement on an individual basis... Could even be done in the software level, so the text is coloured white (or page colour) son as not to distract from the rest of the document, but still visible to any text extraction system. – DaveM May 14 '15 at 13:39
  • 3
    From a more practical point of view, do not forget that customs have got plenty of time and do not care if they ruin your business by keeping you in a 8 hours interview, making you miss your appointment, and seizing all of your devices "for further analysis", making you loose all of the material you had, for instance, to show to a potential customer. In other words, at the end, being "over-dirty" might bother you much more than it may bother them, which is not the case if you remain clean and they have therefore no justification for any kind of further investigation. – WhiteWinterWolf May 14 '15 at 14:04
  • @WhiteWinterWolf fair point. The idea is that there is so much noise they need to go through everything. You can just say... Knock yourself out, search away, make a copy but let me go on my way. The idea isn't to hide your data, its to make iit too time consuming to be able to get through every bodies work. If they searched my hard disk they would find gigabytes of genetic code. I'm not sure how mad they will go looking through strings of ATGC just trying to find an actual word. – DaveM May 14 '15 at 18:37
  • 2
    "You can just say... Knock yourself out, search away, make a copy but let me go on my way." Yes, you can say whatever you like. In this case, they will respond, "No, you're staying right here." Your move. – David Richerby May 16 '15 at 11:45
-1

You can hide the fact that you have heavily encrypted files by using the one time pad method. You can dump (encrypted) data from sensitive files in the form of fake high ISO noise in image files. To decrypt, you must have access to the original image files via e.g. Google Drive. If someone gains access to your Google Drive account they will only see image files, they won't suspect that you need to combine these files with the ones on your computer to extract the files (which then need to be decrypted using conventional means).

You an then travel while pretending to be just another tourist who is proud to show off his pictures to the border guards.

  • 1
    This is theoretically sound, but in the absence of off-the-shelf software to execute it with attention to all the details, is likely to get people in even more trouble when, not if, it fails. – zwol May 11 '15 at 18:26
  • It's ultimately just addition of bits (addition modulo 2), it's the most simple form of encryption you can think about. You may need a hex editor and some basic photo editing software like ImageJ or ImageMagick. – Count Iblis May 11 '15 at 18:33
  • 2
    It is nonetheless subject to any number of operational security problems which render it extremely difficult to execute safely by hand. – zwol May 11 '15 at 18:55
  • Just wanted to chime in that you should absolutely never ever store anything meant to be kept secure on any third party service ever. Also ensure that if you do store something remotely on private servers, ensure the data never leaves the borders of the united states. This is how NSA legally spies on Americans. They cooperate with companies like google, google then decides to "randomly" move the server data containing your shiz to an out of country server, then back to the USA, making it legally searchable/crackable/copyable by the NSA. (external and thus "non-american" inbound data logic). – user7933 May 12 '15 at 23:12
  • 1
    @CountIblis Unless, of course, they've read this answer and suspect you might have done such a thing... – phyrfox May 13 '15 at 17:08

protected by AviD May 17 '15 at 19:48

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.