They probably have a semi-automatic data collection system where you can type in a name, and it collects all sorts of public data in real time. To a non-technical person, this can look like they have a file on you, when in reality this crawler just compiled all the data in a few minutes.

I use one of those tools at work. It's called Google :)

Right... It's probably more sophisticated like that. Similar to what many HR departments use to screen future employees.

HR departments just use Google...

There are subscription services that do all the dirty work for you. Like beenverified.com (However that explicitly "forbids" its users to use it for employment verification. Pinky promise!)

Why would they? That's incredibly risky from a legal point of view.

So they like to say...

I'm no friend of FB or the US.

But the idea that somehow all FB messages are thoroughly searched seems .. unlikely.

The German article says the girl 'found a nice family' and had 'a regular contact with her guest dad'. How unlikely is it, that the guest dad - or someone with access to his account .. - notified the border control?

I refuse to believe in the Orwellian surveillance theory here and put my money on a jealous spouse.

They do sometimes ask to see your phone.

Do you recall any specific story where they ask you to unlock it?

All electronic devices are subject to search at the U.S. border.

http://www.dhs.gov/sites/default/files/publications/crcl-bor...

No. (Thank the stars for Alex Kozinski).

http://www.techdirt.com/articles/20130308/13380622263/9th-ci...

Let me be more specific. All that is required is "reasonable suspicion" in order to require access to all the files on your computer, unencrypted. "Reasonable suspicion" is a very weak requirement, as you can see from the document linked to in the techdirt article, and is exactly the same as what is needed for an extended physical search or an extended search of non-electronic property. In other words, there are no special considerations that apply to property just because it is electronic.

Israel regularly makes people log into email and social media accounts.

http://www.huffingtonpost.com/2012/06/04/israel-airport-emai...

Oh, don't get me started..

I still cringe about multiple 'turn on the computer' scenes in Tel Aviv, where 'turn it on' obviously (..) wasn't satisfied by pressing the button, nor by logging in: I had to 'open a file, just any file' (the clueless guys would be impatient by now, being annoyed by my failure to understand this useless requirement). Usually I chose a default windows wallpaper -> Done.

Braindead, waste of time.

It's fairly easy to rig a laptop display to a micro controller just clever enough to run a login screen simulator, gut out the actual computer electronics and battery, and replace them with contraband or a bomb. Tel Aviv security, which I've been through several times, want to be sure the computer is of the kind it's supposed to be.

Login screen simulators are old tech. Friends of mine used to run them on the terminals at the college I studied at in the 80s to harvest other student's account details. Nowadays they're a lot more sophisticated. If you think you know more about security than the Israelis you're sadly mistaken.

Yeah. Right. I've been through that stuff a number of times myself. More than a dozen times.

You do realize that the process I'm talking about happens after they (always.. always.. sigh) x-rayed your belongings like everywhere else and (this is special, I get that treatment every time) polished all my electronic equipment with their 'sniffer' pads for traces of whatever explosives I might've built into my laptop?

That totally ignores that both times that I had to do this weird 'proof it works' dance by .. clicking myself, doing what came to my mind (and what I considered nonsense). If your world allows for a cramped micro controller that kind of simulates an OS booting, plus the login screen: Hey, let me raise you a Raspberry Pi in a laptop case, that __actually_ runs a full operating system.

It's bullshit, there's no way to make it better.

Disclaimer: I like the country, love Tel Aviv and certainly don't claim to be an expert on terrorism. But I can recognize IT related crap when I see it.

I mean, if you were willing to invest that sort of effort, it might even be easier just to put the innards from a modern slim "ultrabook" laptop into the case of a 2000 era thinkpad monster. Throw on a "third party extended battery" for good measure... Actually, don't bother with that. There is plenty of air-space in many older laptops that you could pack with explosives if you don't worry about being able to run the computer for more than several minutes without it overheating...

The entire "turn on the computer" check is idiotic security theater. Either they can tell if there is a bomb in the computer anyway through other means (in which case why are they bothering to do that check?) or they cannot (in which case, how can they possibly hope to catch anything?). My money is obviously on the first.

Which is why the security agent is spending a lot more attention on you while you're powering stuff up and entering passwords than they are on what's happening on the screen. In TSA checks the chefs themselves, imperfect as they may be, are the point. At Tel Aviv its the responses and behaviour of the people being checked that's the real focus. Not that the checks are totally pointless, they are perfectly capable of catching amateurs or the incompetent, but don't imagine for a second that Israeli border guards are just as clueless as the average TSA agent.

Depends how smart the "average terrorist" would be. Because you would catch the ones stupid enough to just gut out the laptop, rendering it inoperative (unless of course for that last one blaze of glory… hem).

Presumably these terrorists would also be caught by the system that catches the slightly smarter terrorists that only gutted the battery, or swapped out the CD drive, or just shoved a bunch of explosives under the palm rest. I mean, those things would be picked up, right?

Asking people to turn on their computers is like a doctor taking your temperature with the back of his hand on your forehead.. right before actually using the digital thermometer anyway.

Once I was looking for the number of the person I was going to stay with in the USA and they asked to have my phone. I said it's okay, I'll find it for you.

> 100. NSA data that requires TS/SAP + full-scope poly to access.

You may be over-estimating the classification level here. The government classification isn't about protecting the secrets of private citizens, only government secrets. I have some experience in this field - handling fingerprints of non-criminals which were classified at the bare minimum for the agency. It would not surprise me if any non-specific NSA drag-net data itself was not classified any higher than CUI - controlled unclassified information.

> The government classification isn't about protecting the secrets of private citizens, only government secrets.

Using that logic, Facebook private messages supplied courtesy of the NSA would be highly classified, considering their collection mechanism would be PRISM or similar closely-held programs.

> I have some experience in this field - handling fingerprints of non-criminals which were classified at the bare minimum for the agency.

Fingerprint data is available to nearly every local law enforcement organization in the country. There's no mystery about the collection method. It's a foregone conclusion that it's aggregated up the chain.

As other comments have said, if immigration officials were using NSA-supplied data, it would likely be in vague, aggregate form that did not hint at the underlying collection mechanism.

That only flies if there is no other possible way for another agency to have acquired the information. An administrative subpoena would be one way to do it -- I expect there is a term for that sort of thing, although the obvious "warrant laundering" does not seem to pull up any meaningful hits in google.

BTW, unless something has changed since I was last in west virginia, fingerprint info is not widely available in the general case. You take prints from an arrestee or latents from an object, you send them to IAFIS for matching and they return hits which may not even include a copy of the matched prints depending on the circumstances.

It shouldn't fly. That's why in my original post NSA was listed dead last as a probable data source, far below normal federal law enforcement means (such as administrative subpoenas). Even those were far less likely than simpler explanations.

As far as fingerprints, I agree the interface available to IAFIS database end-users may be restrictive. However, due to the highly aggregated nature of the data, and the fact it's maintained for law enforcement by law enforcement (namely the FBI), people expect it to be available to a myriad of government agencies (which it is).

With Facebook private messages, you expect only Facebook employees (or partners) to have access, or in special cases government via warrant or subpoena. Major tech companies took a fairly large PR hit following the news of NSA having wholesale access to their systems, precisely because of these expectations.

If the headline was instead "FBI grants NSA full unrestricted IAFIS access." nobody would bat an eye, because it's expected. The FBI is heavily involved in national security affairs themselves.

My point was, the sensitivity of the collection method is a major factor in determining the classification level of the data. The PRISM leak is a prime example of this.

Do you really believe they're getting administrative subpoenas to Facebook for every 18-year-old tourist who might do some side work?

No.

What I believe is that if the NSA are already monitoring someone for whatever reason and see evidence of law-breaking that they would call up an appropriately cleared contact in the relevant agency and say, hey you should look into this person. The agency is free to run with it from there, using whatever tools with minimal oversight are available to them and no need to even mention the NSA after that point.

In fact, I believe that the number of actual terrorists is so small that such (ab)uses of the system are inevitable. In the same way that all the federal money for SWAT training of police departments has resulted in SWAT teams being deployed for all manner of low-risk situations, there just ain't enough real work for them to do so the mission creeps.