This is actually a favored method to do an end-run around your rights: just get a foreign state to violate them instead.
> Documents leaked by Snowden in 2013 revealed that the FVEY has been spying on one another's citizens and sharing the collected information with each other, although the FVEY nations maintain that this was done legally. It has been claimed that FVEY nations have been sharing intelligence in order to circumvent domestic laws, but only one court case in Canada has found any FVEY nation breaking domestic laws when sharing intelligence with a FVEYs partner.[11][12][13][14]
[citation needed]
The very first sentence you quoted doesn't cite any of Snowden's docs that says that. The very next sentence you quoted has a bunch of citations that say the opposite. In fact, conspiracy theorists speculated what you claim after Snowden dumped his documents, but none of Snowden's documents corroborated that claim.
Previously discussed: https://news.ycombinator.com/item?id=35763700
So much trust involved in a possibly nuclear-level scenario, and you're not curious at all how that trust was built up? Such as by sharing intelligence?
Because they don't spy on each other and they share intelligence gathered elsewhere, as the agreement says. Why would you jump to the conclusion that this quote means they help each other break their respective countries' laws despite complete lack of evidence?
https://www.aclu.org/other/constitution-100-mile-border-zone
But then there's also this:
> In practice, Border Patrol agents routinely ignore or misunderstand the limits of their legal authority in the course of individual stops, resulting in violations of the constitutional rights of innocent people. These problems are compounded by inadequate training for Border Patrol agents, a lack of oversight by CBP and the U.S. Department of Homeland Security, and the consistent failure of CBP to hold agents accountable for abuse. No matter what CBP officers and Border Patrol agents think, our Constitution applies throughout the United States, including within this “100-mile border zone.”
I guess we could go back to 1910 and only import stuff and admit people in coastal cities. Make everyone from Europe fly to JFK on the way to Atlanta.
Pretending I don't have Fourth Amendment rights on one side of the Customs desk at said ports of entry is not.
As for coastal areas, though, If CBP can stop me away from the border without a warrant and without reasonable suspicion of a crime, that IMO is a Fourth Amendment violation. The ACLU cites specific cases of this happening: https://www.aclu.org/sites/default/files/field_document/14_9...
> Between 2006 and 2010 in the Rochester, NY, area, approximately 300 immigrants with legal status were arrested by Border Patrol agents, then released
They also cite the regulations establishing the 100 mile rule: https://www.law.cornell.edu/cfr/text/8/287.1 defines "reasonable distance" and "external boundary", and https://www.law.cornell.edu/uscode/text/8/1357 utilizes those definitions to do things like "without warrant... interrogate any alien or person believed to be an alien as to his right to be or to remain in the United States" and "to board and search for aliens... any railway car, aircraft, conveyance, or vehicle".
It's quite clear that significant parts (all?) of Delaware fall within that claimed jurisdiction.
The border patrol is allowed to operate up to 100 miles from the border or in the vicinity of international airports. They need to meet the reasonable suspicion standard to initiate a stop.
You mean, "it smells like weed"?
"Odd because I have been detained at CBP checkpoints inside the US"
You cannot stop a person inside the US and request they produce any kind of identification without first detaining them. The CBP detains everyone. If you prove you're a citizen, you can leave after being detained.
This is different than everywhere else in the country. It is the fundamental civil rights violation which is being objected to above.
How does that even work? I don't know anyone who regularly carries around their passport, or some other proof of citizenship. A driver's license or state ID isn't enough to establish citizenship, or even legal immigration status. (Though I suppose they could cross-reference your identity, based on the state-issued ID, with whatever databases have that information.)
Personally I refused to answer, set the parking brake, turned the car off, and removed the key. They told me to go to secondary and I just didn't say anything and kept looking forward. Eventually enough traffic backed up behind me on the freeway they just waived me through to get traffic moving again. I know the courts have found it to be legal, but I don't care. I'm not going to comply. If no one complied they wouldn't be able to get away with this shit. Unfortunately most people don't care.
Usually with the border patrol stops a vehicle they ask if there are any non-citizens in the vehicle. If you lie at this point and they don't believe you it would likely give cause to investigate further. So either tell the truth or shut up.
Given that any documented not-citizens are supposed to carry their permanent resident card or passport with them at all times then the assumption is that any not-citizens are doing just that so can easily prove their status. Not everyone does and in recent years they've been policing this a lot harder than they used to and you can find yourself in hot water if you encounter the wrong officer (most cases you will get a very stern talking to).
So if you aren't carrying a permanent resident card or passport then the assumption is that you are either a citizen or undocumented. How hard they push to find out which depends on the bias of the officer making the stop.
Look up "stop and identify." You don't have to present any kind of documents if you're a citizen. You do have to identify yourself, and yes it's vaguely defined. Generally this means name and address. An ID will also provide this info.
The officers will call in your information, check warrants and resident status, etc.
https://en.wikipedia.org/wiki/United_States_Border_Patrol_in...
> The United States Supreme Court ruled that Border Patrol agents may stop a vehicle at fixed checkpoints for brief questioning of its occupants even if there is no reason to believe that the particular vehicle contains illegal people. The Court further held that Border Patrol agents "have wide discretion" to refer motorists selectively to a secondary inspection area for additional brief questioning.
There's no outward sign of citizenship, nor are citizens required to carry proof of it.
Stop keeping that information on their phone: not always possible. Many highly-secure places require you to coordinate with an application on your phone when authenticating. In my experience, there is rarely a non-mobile option presented to users.
That means any and all of that information is already in the hands of the US government.
If you want to think about the attack surface, look at companies that serve other companies and ask "what can someone with root on all of this companies machines do?" and more importantly "How mature are these companies security teams?" Imagine compromising a law firm, a public relation agency, or a newspaper. A VPN provider, a corpnet provider, or a cloud provider.
My password vault doesn't have my ssh keys, but it does have my no 2fac required github recovery tokens. Phones have a lot more than just security tokens. They could provide information useful for phishing or extortion, too.
I think you asked this because I used a rather grand example and that's fair. If I were to look at my post critically I think I under-stated both the potential security mitigations in place by competent security teams and the difficulty of really compromising someone's phone, and therefore somewhat overstated the problem.
When playing war games, you give your opponent every conceivable advantage somewhat grounded in reality, and I have given this idealized attacker the advantage of an incompetent security team, easy compromise of phone, and lack of political consequences for taking a phone out of someone's sight and/or compelling them to enter passwords by threat of force.
If you had an intelligence agency with a significant amount of APT penetration, you might look up every person who requests a visa on LinkedIn and determine if they can amplify the position of your APTs. Maybe you have compromised a taxi app or and and know what hotel they are going to and you can steal a notebook when they leave the room.
I think phone out of your possession is a credible attack, maybe less so today, absolutely 10 years ago it was. Pegasus is a thing, and there were definitely rumors that Chinese police had a little USB stick they could put into peoples phones that would install an app that then disappears from the home screen.
For as long as I can remember, it is hammered into every person who works around security that "no physical security means no security." Losing possession of your phone is the loss of physical security.
My wife's laptop just got compromised a couple of weeks ago, and I've been diving down the security rabbit hole of figuring out how it happened, what's going on on my network and my computer and phones etc. It has been a rude awakening as to the sheer amount of blind trust I've been placing in all my devices. After watching what network traffic comes and goes on my laptop and how much info gets recorded by the system I've come to the conclusion that modern OSes and browsers that aren't explicitly privacy focuses are basically spyware. My new mindset is 'assume everything is compromised at all times and treat it accordingly'.
What OS? I assume Windows? What kind of artifacts have you already discovered?
DNS is a surprisingly fruitful thing to pay attention to.
Some viruses will delete themselves if they detect things like Wireshark or Python are installed.
I believe this is one of the big boy tools, though I haven't used it: https://www.volatilityfoundation.org/about
https://www.varonis.com/blog/how-to-use-volatility looks like a fun exercise.
What I did discover is that by default Chrome captures and stores every field you submit to every form in a SQLite database. The amount of PII that turned up was absolutely staggering. If I could only exfiltrate one file from a machine, it would be that.
It sort of boggles the mind that that's a thing at all. I don't ever want to touch a browser ever again.
This whole strategy depends on the fact that by the time you realize you might not want to have your "real" phone on you, you can't do anything about it.
From a technical perspective we need a phone where you can dump out the main memory chips and swap in a blank firmware image quickly.
I suspect it's possible to design a phone which entirely uses removable storage, but beyond devboard-like systems, I'm not aware of any.
There is also a way to restore the deleted info from a backup server once you have the phone back.
US soft power can influence international norms.
US agents not having access to travel devices means US international travelers can reduce their risk exposure. Travelers can chose not to visit countries that will search their devices. If the US searches phones, it is is much harder for a US traveler to manage the risk.
So, as much as I like the idea of being free to take my phone to another nation without my rigorous digital hygiene routine, I know that the US is never going to cast off its great defensive and offensive SigInt advantages. And I doubt this kind of case could ever make it past an appellate court, because every appellate judge knows that limiting Presidential power in any way immediately dashes any hopes of making it the running for a Supreme Court appointment.
Where do you get that idea? Pretty sure there are several three-letter agencies in the US that would disagree with that statement.
Learning the language and customs of a foreign country to a deep enough level to fool even people looking for you into believing that you're a native doesn't seem like a remotely intractable problem.
My point was more that this isn't a deep part of our culture (the way it is in Russia), rather I think we spun up a lot of these programs after the national security apparatus failed to stop 9/11 or divert us away from a pointless war in Iraq. Based on the instant collapse of the Afghan government without US troop support, I can only conclude that we lacked sufficient HumInt capacity to understand that context well enough to form an enduring strategy.
So my point there is more that HumInt isn't one of our natural strengths, the way SigInt is.
Border agents with unchecked discretionary power is also a slight against rule of law and I think warrants are a check on that power. Maybe they are more checked than I believe them to be or have less discretionary power than I believe them to have. I am open to the idea that I am wrong.
There is absolutely a distinction to be made between a foreigner and a citizen and their respective personal properties.
But that distinction is not relevant in this case. Case in point: your luggage.
Try using your status as a citizen to refuse your luggage to be inspected for contraband or taxable imports when returning to your home country from one with which it does not share a tax and customs union, and see how that goes.
We have the Visa application and interview process for that.
> There is absolutely a distinction to be made between a foreigner and a citizen and their respective personal properties.
Could you pinpoint this distincrion?
What would I be allowed to carry through US border as a citizen but not as a foreigner? Guns? Cocaine? Illegal french cheese?
I think you are resting in fallse comfort that your possesions are more protected than those of unwashed foreign masses.
> Imagine if a foreign intelligence agency managed to get a border guard asset.
Sounds like a great reason for Corp IT to not allow anything too important to go on mobile devices.
(Which is already how Corp IT in most well-ran firms operates, not because they are afraid of compromised border assets, but because they are afraid of a million other, mundane reasons for why corp access on a phone can turn into a security and compliance problem.)
That is a national security concern.
And, no, I don’t mean “warrantless searches of those devices raise national security concerns”, I mean, that state of affairs irrespective of US government search policies is a national security concern.
I'm interested in reading that if you have a link.
And not for nothing, but a yubikey isn’t exactly protected from border agents either. At least a phone has some legal protections now.
Needing a warrant, means you have to articulate why you want to invade someone's private life, and it further provides a chain of accountability.
It prevents rogue employees(peace officer, border patrol) from doing whatever they want, it provides oversight, it provides a second set of eyes, it provides for adherence to legislation and court decisions!
Yet I see people thinking it's some sort of horrible requirement. So bizarre.
So that can be pretty serious for senior staff, infrastructure team members, and so on.
So in many case 2FA is broken unless you decorelate access to app/password and sim card, which mean accessing your apps/systems through a second device instead of your main phone such as another simless phone, laptop, ipod touch, or tablet. Most people would never do that for conveniency reason...But in that case the same search rules/laws apply to second device anyway so it doesn't change anything to the core issue.
This is either bullshit or those people are idiots carrying around that kind of information on a cell phone and crossing borders with it.
I know people who have two factor codes and password vaults on their phone's that if compromised by a competent attacker could compromise nearly every major corporation in America.
Imagine if a foreign intelligence agency managed to get a border guard asset.
Even from a reciprocity point of view, if we search other people's phones, that sets expectations that ours can get searched too. It's dangerous precedent all around.