If you ever get asked that question at the US border, please don't acquiesce to that request. They have the right to ask, and they even have the power to search it regardless of your permission, but despite an alarming drift towards a total surveillance, they have not established the right to force you to unlock/decrypt anything.
I'm flying into SFO tomorrow, and I am taking similar precautions as chx so that my laptop doesn't contain any meaningful data[1].
However, if asked to unlock my laptop, I plan to say "No, of course I cannot do that; it violates the most basic security practices and I could and should be fired if I exposed sensitive company data in that manner." And then just sticking with it. It will be inconvenient, especially if they seize my laptop and detain me, but as citizens it is up to us to resist the normalization of behaviors that push the nation further towards the precipice of idiotism.
[1]: As an American citizen, I have routinely done this when traveling to authoritarian nations like China; it's hard to express how outraged I am that my own country has degenerated to the point where sound security practices now require these kinds of procedures when traveling to the USA.
Absolutely agreed. I will do this[0]. I'm a U.S. citizen with the unequivocal right to enter the country once my citizenship has been established. U.S. citizens are the only ones who can stand up to this madness--either at the border or by influencing and electing people who can change the written law and how it is enforced--and it's our responsibility to do so.
I've entered the country several times and have never gotten more than a "passport, please" request (except, oddly, when driving south from Canada; they're rather surly at the Peace Arch, in my experience), which I recognize is very lucky of me. When I travel, I'm enough of a worry-wart that I build in a lot of spare time to get to and from my destination. "Do you want to fly today" and "you'll be screened for four additional hours" are threats that hold no weight with me, thankfully. I'm in no hurry.
I'm the ideal test case. I have oodles of paid vacation time, a family full of lawyers, and a ornery streak a kilometer wide. Bring it.
0 - I can't say "I have done this" because it's never come up but I'm resolute. "No" is my answer, if it ever does, and I'm sticking with it.
After being locked in secondary with no comms, food, or water for hours on hours enough times, one gives up. CBP once kicked me out of a border control point in northern Vermont, in a snowstorm, in February. I had to hitchhike simply to not freeze (my sim didn't work, so no way to call a cab, and they had sent the bus on without me, hours earlier).
I've been searched, both well and also simply as intimidation, more times than I can remember. Most searches are not thorough in any capacity, but simple displays of power and dominance.
My foreign partners have been repeatedly groped by these pigs. Vacations have been ruined simply by traveling together - they deny foreigners entry.
The file still haunts me. Every time I enter, secondary - with associated 30-500 minutes of delay.
There's no recourse.
I cringe every time I exit the US, for the 2-10 hours I will lose upon my next re-entry.
Their capacity to waste your time is infinite. Your time is finite.
PS: they can also take all your devices for imaging and keep them for 48 hours - but you will likely have to sue them to get them back after that time. Crossing in can be a >$10k/entry affair if they wish it to be, for you.
Out of curiosity, do you know if there are any people trying to challenge these rulings/treatment they receive in court?
Actually is that possible in the US or do the border officials still have a stick up their arse? I mean if you work for a big multinational IT company, surely they can provide a few hundred bucks to bribe someone to skip security. Bribing the police is normal in a lot of countries.
" -sir, we have to strip your car to search it for contraband.
-Ok, how long it's going to take?
- About 24-48 hours, but it might take longer if we see anything suspicious
- ok, what do I do in the meantime?
- you can sit on the bench there
- for 48 hours?
- that's correct
- I happen to have this nice bottle of vodka, would you like it as a thank you for your hard service?
- hmmmm I have to check with my superior [ comes back 5 minutes later] - that's fine, we don't need to check your car today, have a safe journey"
Nowadays I'm being told that this practice has been eradicated almost everywhere, but it basically relied on border control agents making your life as miserable as physically possible in hope that you will pay up. If you decided not to, they would eventually let you go, but you're wasting only your own time, they had infinite amount of it and perfect justification for everything they did.
Please elaborate on that.
Amazon: "Employees may not bribe anyone for any reason, whether in dealings with governments or the private sector. " [3]
Apple: "Apple does not offer or accept bribes or kickbacks in any form, and we do not tolerate corruption in connection with any of our business dealings." [2]
Google: "The rule for us at Google is simple – don’t bribe anybody, anytime, for any reason."[1]
[1] https://abc.xyz/investor/other/google-code-of-conduct.html [2] http://files.shareholder.com/downloads/AAPL/0x0x803576/DAFD8... [3] http://phx.corporate-ir.net/phoenix.zhtml?c=97664&p=irol-gov... [4] https://en.wikipedia.org/wiki/Foreign_Corrupt_Practices_Act
For future, for the rest of us, I'm wondering what civil disobedience would look like. Something akin to malicious compliance, work to rule, or...? Actions (or inactions) that we can take to make the whole process infeasible.
For example... Whenever a telemarketer cold calls me, I try to take up as much of their time as possible. Increase their costs, reduce their conversion rate.
I also try to lie as much as possible for forms, surveys, etc. Muddy the data. Increase their costs.
You don't really want them back, anyway. So you just don't carry anything valuable, in any sense.
That's called a vacation.
What you describe is simply impractical for a person in my line of work.
[1] https://www.theverge.com/2017/5/22/15676696/hbo-silicon-vall...
I guess I could get a fourth phone, the one I use only for talking to my Airport Phone Guy, who would somehow be incorruptible enough to not hijack my bitcoin wallet or take copies of my camera roll (which, if used strategically, could alternately make or ruin entire careers or companies).
I'll be over here in the Real World.
This was back in the 1990s, when asking for your password wasn't a thing I've ever heard of them doing, but also when me bringing 128-bit encryption software (aka the US version of Netscape Navigator) to Japan, where I was a foreign student, was a serious crime akin to arms smuggling.
Of course, I never found out for sure why I was on that list, and eventually I apparently wasn't on it anymore. But during that time I did read a fascinating article in some magazine, by Nathan Myhrvold (the now-infamous patent troll scumbag). Apparently, he was on the same list, despite being a super rich fat white guy from Microsoft.
His theory was that he got on the list by buying one-way plane tickets in cash. That resonated with me, because I often did the same thing back then… I just never really knew when I wanted to come back, and I didn't have much credit on my one credit card.
That's obviously both circumstantial and anecdotal, however I don't think it really takes too much to get on one of these secret (and very probably unlawful, but effectively un-challengeable) lists.
What could the "fat" part of that possibly have to do with anything related to targeting, other than as a cheap excuse for you to denigrate Myhrvold?
But also, yeah: fuck Nathan Myhrvold. He's a smarmy piece of shit whose parasitical exploitation of America's societal weaknesses and dysfunction far outweighs all the modest contributions he's ever made. I hope he trips and falls face-first into one of his large sous-vide contraptions.
(That time, I was denigrating him on purpose.)
NSA didn't want to allow Microsoft to build RSA into Windows and export it. Even though the cat was out of the bag and foreign OEMs and vendors were already selling RSA. NSA wanted Microsoft to not give users more than 40 bits of encryption keys.
So Myhrvold, as President of Microsoft, flippantly offered to pad the keys generated by Windows with NSA's public RSA key. Win Win. Users can export more than 40 bits, and NSA gets a backdoor.
Microsoft won and was allowed to export software using RSA. No doubt that little stunt put Myhrvold on some Watchlist for Life.
It's too bad he became evil after he became a billionaire and started only caring about money and Yachts and hob knobbing with other 1% elites.
Border guards have the power to prevent you from entering the country if they believe your business is unlawful, and asking those questions is one of the ways they decide. We can question whether border guards ought to exist, but, given that they do, refusing to answer their questions seems like a ticket to a back room for hours.
You really never answered their questions on every entry?
If exercising my human rights is "a ticket to a back room for hours", then something is fundamentally broken in our society. You should try it; without doing so you actually have no data about the practical perimeter of your basic rights. This stuff isn't printed in the newspaper.
Yes, I really never answered their questions, except the ones about citizenship and nationality and place of birth—which I answered by presenting my passport.
"Business or pleasure?" is a vague, leading question designed to get you to volunteer as much information as possible. Sometimes I replied "no" or "yes" to that one, with an occasional "On advice of my attorney I decline to answer questions from police except in writing and via counsel" thrown in to break up the monotony.
Never talk to the police.
No. The USA can never deny entry to citizens (nor any other country). They may arrest you on the spot, but can't deny you entry.
Green card holders is a different story, they have no right to enter and are at the discretion of the authorities.
You have to balance your civic duty as a citizen with whatever else is going on. But hopefully our default mode is to emphasize our responsibility as democratic citizens to lead by example, and to resist degenerate behavior whenever we can...
Scratch that last bit. There is no need to reveal that, and it could sound suspicious (like you are trying to hide something specific by circumventing their checks, and trying to look clever (and/or make them look dim) by doing so to boot).
Just be honest without giving extra information: "yes sir, this is a travel machine and it just contains what I'm going to need while I'm between locations" if they ask why you would do that then "in case the laptop gets stolen, the less that is on it the less of a worry that could be" strikes me as a perfectly valid reason to be careful. Or perhaps "all the other data and programs I'm going to need are already with the clients/suppliers/other I'm visiting" (which it is as you've posted it, but you don't have to say the thing that might unnecessarily raise suspicion).
Are there any examples of laptops / ssds being searched in international mail?
Are you protecting against "drive-bys", the casually curious, motivated low-resource targeted attacks (e.g. disgruntled former employees, hated neighbors), "small" resource targeted attacks (<$50k?), high-resource attacks or state entities?
I mean many "average" people get searched on airports, but i don't see why they would intercept an average guys Fedex shipped harddisk and do some voodoo on it. Unless of course you know you're being targeted for some specific reason.
Snowden leaks already show NSA has badbios-style firmware viruses targeting every manufacturer, every model, going back a decade. Imagine what they have today. Why not mass infect all hard drives at the factory? Targeting individuals or "thematic warrants" are still too clunk and doesn't scale.
All these folks who say "I'll out smart them, I'll encrypt my SSD and Fedex it" are "Not Even Wrong."
Also, not to mention most of my hard drives are made by China, whom seem not to like the NSA very much. This leads me to believe that they may struggle with the mass infection part.
"I'm denying you the ability to enter the country. Next time you let me see everything instead of being a wise guy."
They can deny foreigners, but I've always read that they cannot deny Americans in unless their citizenship gets revoked, I guess.
The future is simply interdiction of every device.
Actually, every device will just be bugged with a thousand backdoors. The end.
Cory Doctorow - general computing is the enemy of governments.
I have a small SSD in the primary disk in my T420s, it has just enough to get me through the flight. I keep the primary in the UltraBay with a simple adapter, takes one reboot and no tools to put it back in place. Done. Happy searching! I can't log into anything even if I wanted to because I physically do not have my password store https://www.passwordstore.org/ with me. (https://github.com/chx/ykgodot I wrote this trivial script to automate yubikey neo with pass)
Alternative: encode the entire primary disk https://github.com/cornelinux/yubikey-luks and FedEx the yubikey. Yanking the disk is better, though.