It's a surprise to me that nobody has pointed to the EFF whitepaper and recommendations on this issue.

Digital Privacy at the U.S. Border: Protecting the Data On Your Devices

https://www.eff.org/wp/digital-privacy-us-border-2017

EFF Border search pocket guide (printable PDF)

https://www.eff.org/document/eff-border-search-pocket-guide

Digital Privacy at the U.S. Border - EFF’s guide to your Constitutional rights at the border

https://www.eff.org/document/digital-privacy-us-border

It has all the information you need to deal with it.

>So, the selfish question then is: How do I protect myself from such unwarranted searches? Is there a way I can present my phone such that it drops into a mode that contains no data? Do I need to back my phone up before traveling, wipe it for the border crossing, and then restore once I feel safe?

Save your encrypted system configuration/data on a service. Leave all your devices behind. Buy new devices on the other side of the border, and restore from the encrypted backup. This is really the only way to completely sidestep the risk.

Until a court rules that they can ask for your encrypted remote backup because reasons. And then hold you in contempt until you comply.

This isn’t a technical problem, it’s a political one, which means it demands a political solution.

Then you can deny you have one, and they won't be able to prove anything. Or you can have two, and then give them the one with a porn collection or something. Or you can have three, in case they suspect you of having two.

Or you just have none, and they detain you indefinitely because you can't prove otherwise… though if you fear that, you probably shouldn't cross the border ever again.

I was wondering what they'd do if they ask for my Facebook account credentials, and I explain to them I have no Facebook account. Will I be detained for lying to an officer of the law? I don't have a Facebook account, but they might not believe me.

As you may have learned in recent news, lying to a Federal officer is a felony. If you have a blank phone, and you tell them you have no backup, and they later find out you did, you could go to prison just for that alone.

And what if you do have a Facebook account, but don't know its password because it's only on a password manager application on your home computer? Or what if you need two-factor authentication to login, but left the device with the second factor at home?

They would detain you, and we'd probably read about it.

> Until a court rules that they can ask for your encrypted remote backup because reasons.

Is there legal precedence for this though? I thought the law (and precedence) was that they can only search what you are carrying with you at the point of entry?

A lot of companies (US and foreign) will send encrypted laptop computers with employees going to the US, and the employees don't get the key. The key will be provided over the phone when, and only when, they arrive at their destination (usually a customer site), and if everything at that time is ok. This is simply to avoid having company intellectual property stolen (because that's what a copy will do). It's not contempt or lying to an officer if you really don't have the key, and even if you called home from the airport you wouldn't get one. This has been quite common for the last decade at least.

Grand-parents question

> How do I protect myself from such unwarranted searches

knows plenty of technical solutions.

The question which needs to be answered in political terms is about the conditions under which it is lawful to put pressure on individuals to warrant such a search.

This is the real answer. The problem is that the government feels entitled to any data they may request of you. Regardless of your technical acumen, they can always fall back on a $5 wrench.

I was just waiting for someone to mention the XKCD Universal Decryptor... a $5 wrench and a length of hose...

You can leave your phone at home and buy another one in the new location. That's why they have phone shops in the airports.

As silly as this sounds, it was standard procedure for one company I worked with. Don't bring your phone, get one from the US office. Same with laptops.

Didn't half speed up border crossings when your itinerary is a week and all you have are your clothes, your passport, some travel money and your tickets.

Don't forget that the border zone extends 100 miles in from the actual border (including the great lakes). Most US people live their entire lives in the constitution free zone where this kind of violation is allowed.

However the authority using "border zone" justification for a warrantless search must also have probable cause to believe you have recently crossed the border.

How probable?

“Most people” seems like a bit of a stretch...

It's not. https://www.aclu.org/know-your-rights-100-mile-border-zone

Not at all[0]. The continental coastline is an "external boundary".

[0]: https://www.aclu.org/other/constitution-100-mile-border-zone

When you get technical about this 100 miles from every international airport is a border as well...

How does that impact that map ?

There is no actual country border at any airport. It's an approximation that has its own rules and is not affected by the international treaty that sets these 100 miles.

The 100 miles have nothing to do with international treaty, but only American courts' interpretation of the fourth amendment.

Isn't that based on the treaty? Sorry if I'm mistaken.

I'm not sure which treaty you're thinking of, but I'm pretty certain it's a purely domestic matter. Note that we're talking about 100 miles inland from the border, not something like 100 miles out to sea.

Yeah, that's my mistake. I thought we're talking out, not in.

65.3 percent live within the border zone.

The "most people" actually comes from the part he left out... it's not just 100 miles from any border, it's 100 miles from any international airport, which does include most people.

IIRC the "100 miles from an airport" part was requested/proposed but never actually happened (presumably because the FBI gang didn't want the CBP gang on it's turf).

No, an intl airport is a point of entry, but not a border.

True, but it looks like the "100 miles from an airport" part of the law was not enacted after all. My mistake.

Most Americans don't protect their data, because most Americans aren't potentially going to be set up by their government to be made to look like some kind of terrorist.

If you happen to be non-white or non-christian or have such as family or who live in a majority Muslim country, then you probably do want to protect yourself against this eventuality. In that case, either bring a dumb/brick phone for them to search, or bring a smartphone which has data on it, but nothing you care about. Don't jump through a lot of hoops to try to fool them, because it'll look suspicious, and then you really aren't going to make your flight.

White Americans just have lower odds. But it only takes the border control officer to find something "suspicious" like a video about nuclear bombs in your youtube history and now you might just be a rotten apple. What you think is fine and what law enforcers think can be quite different.

I'm not saying you should live in fear, just that these kind of checks are not good for anyone. Not even if you carry your sweater over your shoulders.

A 'blame the victim' mentality gives breathing space to the bully. 'Blame the bully' and at least they might apply some discretion, to counter negative attention to themselves or their superiors. Enforcement jobs, including border patrol, can self-select for sadists and racists, so it's probably best the public remains vigilant to the prospect of their increasing power.

Of course it would be better if the "bully" was removed or reformed.

However, until that happens (which might be never), it's prudent to protect yourself, and telling people that they must take precautions for their own safety and well-being is not "blaming the victim".

There are almost no technical solutions. A freshly wiped phone or any clever encryption gimmick can raise suspicion and make things worse.

AFAIK companies are the exception, unsurprisingly. Some companies require laptop and phone wiping before travel, and if you can prove you are following company policy it might be OK.

They can obviously be as suspicious as they like to but they can be like that anyway. If they choose to believe you have two Facebook accounts, one to show to authorities and the other to plan terrorist attacks with, then how can you prove them wrong.

Don't carry any passwords with you so you can not login any service or device even if you wanted to. Leave them at home. A good reason to wipe your stuff prior your journey would be to minimise trouble if your equipment got stolen or lost (a plausible threat when travelling).

I would tend to think there's nothing you can do to prevent them getting suspicious if they choose to do so. It's a bit unfair because it's a situation where you can't count on anything even if you have nothing to hide but that's, to my knowledge, just how it is.

For mobile devices there are apps that will pretend to be something innocuous (say, a clock, or a flashlight app), and actually work as hidden storage. It would depend on whether the agents are using computerized inspection or manually looking through your phone (as they could easily build a blacklist of such apps), but if they're doing it manually and the app really does do the function it suggests it does and has a hidden unlock mechanism, they won't detect it.

For laptops, you can install multiple operating systems and simply set the BIOS or EFI bootloader to boot the dummy one by default when going to the airport and make sure the dummy hides the partitions of the real one. Once again, this will fool manual inspection, but not computerized. Fooling computerized inspection would require placing the real encrypted file system within the dummy one, without any headers indicating that it's a file system: much more complicated and can lead to data loss if the dummy system writes over it.

Either way, you don't want to simply wipe everything and restore once you're across borders if you actually want to cross. For one, there's the chance they'll just confiscate your device, but if you're not a citizen of the country you're entering, they'll just deny you entry on suspicion. You want something that's fake, but convincing, which takes effort.

Cheap thinkpad, throw on some random software, browse with it for a month.

That's what I plan to do.

>>It feels crazy to ask this question, as an American citizen, but HN, what do you do to protect your data at the American border?

In reality you can't without (potentially) causing yourself massive problems. Missing flights, detained for longer because you are hiding something because of wiped drives, encryption etc. etc. Oh, and they might add your name to lists that make your life miserable every-time you fly. So, unless a court rules in our favor, we're screwed.

Use a separate phone for international travel. Don't connect it to any of your normal accounts.

It’s sad but not unreasonable that you implicitly discount the possibility of a political solution.

Don't use fingerprint or face unlock. Passcode/pattern only.

They’ll still detain you till you input your passcode. Or they’ll beat you with a rubber hose, if you’re in those parts of the world.

> those parts of the world.

Somehow the only horror stories I read (or experience) is about US or five eyes (NZ being exception).

People in those other countries don't have a right to complain. If you have something incriminating in many countries you just disappear, possibly after a show trial.

They can detain your phone, but if you're a US citizen, they can't detain you for very long.

ICE and CBP can, in practice, hold someone a very long time if they really want to. It just rarely happens.

https://www.latimes.com/local/lanow/la-me-citizens-ice-20180...

They can also make up imaginary charges against you to have you jailed, as cops in the US love to do. Any time an innocent person is gunned down, there's inevitably a story about how they 'charged the officer' or had a weapon or whatever, and then when evidence appears to contradict that, the lie is quietly retracted.

You might say 'well, I have my ID while traveling, so it's fine', but ID is not always considered proof of citizenship. They could drag you aside at security (or elsewhere), decide they don't like the look of you, and decide that your ID isn't proof that you're a citizen. Spend a week or two in jail.

There's no perfect security, and biolocks are absolutely useless for protecting phone access, especially in the US where they have zero 4th Amendment protection.

> Is there a way I can present my phone such that it drops into a mode that contains no data?

Yes: don't have a phone. If they press you, it broke last night and you didn't have time to fix or replace it before traveling internationally.

Back it up to the cloud and wipe it. Download backup on other side. Sure, officer, have at it <grin>.

"Why is your phone completely blank? What are you trying to hide? Give me your Facebook login or you're going nowhere. Okay thanks, but you're still going nowhere... and your flight just left. That'll be $2000 for a new ticket."

Well, sir, I'm glad you asked. I just upgraded for this trip and am very excited to try out the new camera as it's supposed to be about two times better than the last model I had. I'm planning on setting everything up on my flight. I do not have a facebook account. I got tired of the data breaches and privacy issues and closed it about a year and a half ago. Am I free to go?

Assuming you do indeed have a FB account, the scene continues like this.

(Officer opens his laptop, searches your name on Facebook and finds someone with your name from the city you live in and your mug as their profile picture).

“Sir, you’re under arrest for the felony crime of lying to a Federal law enforcement agent. You have the right to remain silent...”

But a smartphone is not blank. What does 'blank' mean really? It's choke full of apps, whether you want them or not, from the factory. If you just use it to call with (as I do), then the only activity is a shortish call log.

I'd expect a response along the lines of this if I presented a factory-erased phone to CBP...

"Everyone has a Facebook sir, even my grandma and my boss. And I'm pressing buttons on your cellphone and it's asking me to set things up, so it's obvious you wiped it and have something to hide. We can do this the easy way or the hard way. Either you start being honest with me, or you're not catching that flight, or any flight. Ever."

Just after factory reset is a bit too far of course. You'll go through the setup. After that it's just as any old phone.

And no, I don't have Facebook, and I'm definitely not alone. It's not something that I would feel problematic to defend.

> It feels crazy to ask this question, as an American citizen, but HN, what do you do to protect your data at the American border?

I guess the real (rhetorical) question is, are you doing this for the principle of the thing or because you have something illegal? If the latter, then the only foolproof way is to travel without a phone, purchase a burner when you get wherever you're going, then destroy it when you leave - it's cheap enough these days to do so for every trip.

If the former, then (as much as I hate this) just accept that it's all theatre and nobody really cares what's on your phone, and just unlock it and let them nose through your happy snaps for a minute on the way through.

> let them nose through your happy snaps for a minute on the way through.

Just so you know, that's not how it has worked since 2013. Now they take your phone to the back room and image your phone. Then they upload that image to a service that searches your data. Then, and there is recent evidence of this, they don't always destroy the local copy of your data in the field office which would allow agents to browse your data at any time. Remember, they require you to unlock (decrypt) your phone before doing this.

I hate this idea. To the best of my knowledge there's no evidence of anything illegal on my phone or any of my social media accounts. But still, I would absolutely loathe the idea of handing over an image of my phone in perpetuity. Might as well give you a scan of the contents of my brain. Not much evidence of law-breaking there either, but I'd rather hold onto it, thank you!

You also plausibly can't trust the phone or any device that got unlocked and sent "into imaging".

Even innocent people can go to jail, taneq.