Posted by floathub 13 hours ago
At this point, people should buy a burner phone when going to/from the US. In that phone only have a couple of phone numbers and that's it.
Issuing 'burner phones' and laptops to staff visiting countries such as China or the USA is now SOP for many companies handling sensitive data, including mine.
Don't think this isn't unusual.
A couple weeks before your trip, factory reset whatever burner phone you're planning on using and swap your SIM card over. Install a few basic apps you wouldn't mind them looking through. Enable hotspot/tethering, and connect your other phone via Wi-Fi.
For a couple of weeks, use the burner as much as you can with what is available on it. When you're driving, us the maps app for GPS. Make and receive some calls, ignore some spam calls. Read the news. Get a few inane text messages conversations going, etc.
When you travel, leave your regular phone at home and take the burner. When it's searched at the border, it has enough activity to pass most initial smell tests. If asked, you dropped your other phone and didn't have time to get it fixed before your trip, this is one a friend lent you.
This has worked for me. Never _actually_ into anything illegal, but just apparently had a suspicious vibe about me or something because every time I crossed the border into or out of the country I was spending 4-5 hours getting searched. Didn't need someone going through my entire life going back decades every time--once was enough.
Believe it or not, due process still generally exists and most people still benefit from taking precautions to protect themselves. That’s not to imply that things are great or that we aren’t in a time of declining civil liberties.
Seriously, there is something wrong with privacy doomers.
This comes across as fearmongering to keep people from protecting themselves.
If you get charged with a crime, things are very different.
There is no court at the border. If the agent decides you're going to jail, you're going to jail. The decision may be reversed/corrected after, but it's still going to be a big, expensive problem for you and you _are_ going to be detained for a time.
Not to mention walking up with an empty phone and telling the agent to "fuck off" when they ask about it sure sounds eerily similar to the facts of the case in the linked article. I'd wager that's a good way to land an obstruction charge.
For the second part, having an empty phone is not a crime, and being arrested for this would be a major scandal. The tech press and political outlets would be all over it. It’s generally a good idea to avoid directly antagonizing border guards, though.
What are you even on about? Having a blank phone is obstruction?
At the end of the day, it's always best to just not have anything "bad" on your devices. People have been caught up for all numbers of "innocent" reasons (pictures of their kids in the bathtub, ancient photos in their albums of themselves doing illegal things such as drugs or underage drinking, text messages or browser history disparaging politicians the border guard may support, porn in your history) that can give a border guard in a bad mood good reason to ruin your day.
I personally don't want my phone data hoovered in and analyzed or marked, even though I don't really have anything to hide. I don't care enough to do anything about it, but if I did I would probably have a second travel phone with a curated amount of data, apps, accounts, etc.
At this point? This has been standard practice for a while now.
1. You factory reset your phone before entering the US and give it to CBP blank. There's nothing to find;
2. You have a self-destruct PIN like this guy did and give it CBP so it destroys the phone's contents.
Tech people will say that these two things are functionally the same. This is a fundamental misunderstanding of how the law works. If you factory reset your phone first with the intention of restoring it after entry, that's completely fine (legally). You could've factory reset that for any reason. But as soon as an officer wants to search your phone, now you're engaging in evidence destruction (spoliation). The destruction to the phone's contents was done in response to an unfortunately lawful search.
Even if you don't want to factory reset your phone, you can probably just delete (or even log out) of key apps. They can still get messages but if you're so concerned about that, use WhatsApp or whatever.
None of this should be necessary but we are where we are. But whatever you do, don't use a self-destruct PIN if you don't want to be charged with a felon and likely to be found guilty.
A factory reset done in anticipation of a search is not as different from using a duress feature as you believe it is. Forensics software would have clearly identified the device was recently factory reset. It would provide another defense argument by arguing it was wiped for another reason, but whether that would be believed by a court is unknown. It would make a difference if there was a good argument about why it was done, but it isn't necessary for this to have been done instead for wiping the device to have been legal.
Once he was in the situation already, the best move was very likely refusing to provide the PIN/password indefinitely and only talking to them to demand access to lawyer. There are strong protections against data extraction and it's highly unlikely they would have been able to get the data from it. Refusing to provide a PIN/password is protected under the 5th amendment in the US and these rights do exist at the border. They can turn away a non-citizen but they can't refuse entry to an American citizen because they won't provide a PIN/password. They could waste a lot of his time but he'd get access to a lawyer and would get released. They could make a court case over demanding the PIN/password and they'd nearly certainly lose. He'd likely spend months or even years without getting back his phone of course.
If they had a video recording of him entering the PIN/password from somewhere, they could have used that to get the data. By using the duress PIN/password, he prevented it. It was probably not necessary to keep the data safe, but that's unknown.
With only a tiny bit of preparation time, rebooting or powering off the device would have gotten it into Before First Unlock state without the locked device auto-reboot timer needing to complete. In Before First Unlock state, a decent random 6 digit PIN is enough for the data stored protected with it to be highly secure without an extremely sophisticated secure element exploit. If the device had a strong passphrase, then no level of sophisticated exploits would recover that data.
This is where machine-like personal consistency is deeply important to opsec. Not just for technical reasons, but for legal reasons also.
If you wipe your phone before every national border crossing and restore it after every border crossing as a part of your standard procedure for travel, it will be much harder for a prosecutor to argue that you have ever done so in anticipation of some particular search. If your employer's security policy mandates doing so, that is even more evidence against anticipating a specific search. If a large body of infosec/cybersecurity professionals advise a wipe/reset of your phone before any and all international travel, that is further evidence for defense.
If you're the subject of a lawful search and you destroy evidence rather than handing it over, that's spoliation. It has legal consequences. Courts are allowed to assume that whatever was destroyed was detrimental to you or your case. You can be charged with it as well. That's basically what happened here.
Consider this example: many companies have an email retention policy where emails will be automatically deleted after a period. I've heard of cases where this has been as little as 14 days. Typically though it's 1-5 years. One of the reasons companies do this is so discovery can't go and dredge up something really old in a lawsuit.
If this is a company policy then that's actually fine (ignoring any regulations or legislation tabout required retention).
Once you get subpoenaed you may get a hold on your email. The company is then required to retain it reagardless of this policy. If you then delete an email, that too is spoliation.
Do you see the difference? CBP can search your device. As soon as they request it, deleting the contents, regardless of what it contains is a crime. Wiping your phone before every border crossing as standard practice is not.
It was likely unnecessary to use the duress PIN/password. He likely would have been better off simply refusing to provide the PIN/password. He could have rebooted or powered off the device before going through but even without that it would have automatically rebooted itself after 18 hours by default, or a lower time if he had configured one.
With a lot more preparation he could have done an encrypted backup, wiped the device and restored it later but that's very inconvenient.
The truth is that the Democrats have no appetite for dismantling the security state because Republicans would screech that they were making Americans less safe and Democrats would rather not have that fight than make a counterargument for civil liberties and Constitutional values.
Clinton's IIRAIRA bill literally introduced expedited removal procedures and created the concept of 'administrative warrants', routinely used by CBP/ICE today.
Without the IIRAIRA, removal would be substantially harder.
https://www.congress.gov/bill/104th-congress/house-bill/2202
https://www.congress.gov/bill/104th-congress/house-bill/3610
It's easier than ever to check legal assertions before you post instead of posting incorrect information.