Slashdot Mirror
Examining the Search and Seizure of Electronics at Airports
Angus McKraken brings us a Washington Post story about how travelers are seeking more well-defined policies and rules about the search and seizure of electronic devices by U.S. Customs officials. The EFF has already taken legal action over similar concerns. We recently discussed the related issue of requiring people to disclose their passwords in order to search their private data. From the Post:
"Maria Udy, a marketing executive with a global travel management firm in Bethesda, said her company laptop was seized by a federal agent as she was flying from Dulles International Airport to London in December 2006. Udy, a British citizen, said the agent told her he had 'a security concern' with her. 'I was basically given the option of handing over my laptop or not getting on that flight,' she said. 'I was assured that my laptop would be given back to me in 10 or 15 days,' said Udy, who continues to fly into and out of the United States. She said the federal agent copied her log-on and password, and asked her to show him a recent document and how she gains access to Microsoft Word. She was asked to pull up her e-mail but could not because of lack of Internet access. With ACTE's help, she pressed for relief. More than a year later, Udy has received neither her laptop nor an explanation."
If you RTFA, the examples appear to be cases of traveling while being Muslim, Middle Eastern or Asian. Any examples of Nordic blondes or Irish Redheads getting the same treatment?
Mobile devices have very large storage, which can be compressed to varying degrees at will, better than 50% averaged across all data types. It wouldn't be very hard to make a filesystem (or other storage type) for any of them that stores an equal amount of fake data, with a fake password, with everything compressed in the same space as an uncompressed set of real data. Such a filesystem could look just like a real filesystem in every way, including total size, but hide the real data behind fake data and fake password. If it's all encrypted, it would be very hard to tell the difference, especially in an airport screening line.
Of course, that would probably violate some law. And "only the bad guys" would do it. But if those bad guys actually have something to hide that also violates those security laws, then of course they'll break that law's "coverup" prohibitions, too.
Terrorist and other criminal orgs with enough resources to be a real threat, and carry notebooks and phones around on flights they don't just blow up, will be able to afford such a filesystem. And once there is one in the wild, anyone will get it, probably for free.
So this is yet another stupid simcurity (simulated security) measure. It's intimidation of everyone to scare us into thinking our government is "doing something severe" to terrorists, when it's just abusing our own freedom. While wasting everyone's time, eroding our trust of our government, and letting the terrorists go free.
Sounds like they're already using sophisticated decoys at DHS: fake security to hide the dangerous absence of any real security.
--
make install -not war
I took a flight once from Dulles to Dublin. They told me my laptop tested positive for nitro glycerin. I said "so?" They said "well nitro glycerin is in a lot of hand lotions" "Then I used hand lotion." The TSA is really hit or miss. I had to take off my flip flop sandals at Louis Armstrong Airport in New Orleans. "You call these shoes?" "They're footwear" And they were patting down a disabled WWII vet in a wheelchair. I told the fresh out of high school kid that he should be embarrassed. That old guy obviously hates America. You're really at their mercy though.
I hate sigs.
Each component of the system, that is supposed to be separate, is in bed with those it is supposed to be a check against. This wouldn't surprise anyone who has paid attention to the way that police officers are treated by judges and prosecutors, especially in "liberal areas" for abusing their authority. In places like Northern Virginia, one of the bluest parts of the country, the prosecutors won't touch a cop who shoots and kills someone in a criminal way while on duty. The very argument for giving them their extra powers over the public is that they're professionals with how they use it, and yet they're more likely to be treated like a well-meaning retarded child with a handgun rather than a professional for whom human error should almost invariably be regarded at first blush as criminal negligence.
The prosecutors will rarely try them, the judges will rarely sanction prosecutors who do things like hound a guy they know is innocent, etc. Why? Because in general, the people in law enforcement, the DA's office and the judiciary are bad apples, with a few good ones mixed in. This applies to federal agencies as well.
Oh, and my laptop might be tricky to search... I wonder what procedures they have in place for people travelling with computers running alternative operating systems or simply in a language the officer cannot understand. 200 translators waiting behind the security booth? sounds practical.
In the article, it says that Radius went to an encrypted network to access company data. Given the recent news of stolen laptops, and the ensuing uproar over the data contained on them, it seems to me that everyone should take this approach. There are very few places that I go in the course of business that don't have some kind of network access. Even the hot dog stand down the street has free wifi, for crying out loud! Of course, you need an access scheme sufficient to keep thieves and DHS agents out of your database, but that's a solved problem with revocable certs, etc.
The note about going through the recent documents log and browser history has me concerned, though. I may set the defaults on my work machine to never-save on the history. I can think of any number of services to archive bookmarks online. The idea here is that your travel machine may be lost, stolen, broken, or compromised at any time, and we should behave as such.
It sucks that we have to protect ourselves from unreasonable search and seizure by our government, but we'll just have to deal with it for now. Not to get off on a rant here, but I think the Second Amendment should be interpreted to include strong encryption. The writers of the Constitution put that in there as a safeguard against jackbooted government thugs. In today's world, I see no political difference between a Kentucky Long Rifle and AES-128.
You've never seen "Day of the Jackal" (the oringal version)? The asassin has a sniper rifle broken down and made into a set of crutches, for an old war veteran...
If you;re going to search people at all, you really should be searching people with large pieces of metal piping, no matter what medals they're wearing.
Yeah, I know, a "movie threat". Still, profiling people to wave through is as bad as profiling people to give a hard time to. Both allow an enemy to game the system
Unfortunately, my employer has made it clear that they want their employees to cooperate fully with these searches, and afterwards tell corporate security. Realistically, it's the only reasonable thing for the company to expect. For one, no company wants to be labeled as "supporting the terrists!" Heck, it could even hurt their ability to win government contracts. For another, TSA is unlikely to back down just because of some corporate security policy. The employee would find themselves unable to board their flight at best (and thus unable to complete whatever task the company assigned to them), and arrested and possibly charged with some absurd federal crime at worst. The business travelers have the most to lose if they refuse to comply.
One poster suggested that government contractors refuse to cooperate, and call their corporate security officer and/or DSS. That's an interesting idea, but someone undergoing a TSA or Customs search won't have any opportunity to contact their security office during the search. They're not going to let you make a cellphone call. You either consent to the search, or you don't. If you don't consent, they might take it anyway, and I'll bet money you wind up in handcuffs.
But what can you do?
Now of course, Airports are beyond miserable. Amen to that.
FWIW, this is why I won't be going back to the US any time soon (although I've been there several times in the past, and to Canada). I really like the US, I like the people and the country. Americans are some of the warmest most friendly and helpful people anywhere in the world. I have relatives there and I could quite happily spend my holidays there every year, one state at a time.
The US tourist board run adverts on TV telling us to come visit at DiscoverAmerica.com, which - given the way they treat you when you do get there, post 9/11 - is entirely a mixed message it seems to me. Trips there are nothing but a hassle with endless queuing and stupid security checks. I've had on multiple trips and the absolutely insane delays and had to deal with concentration-camp guards that pass for Airport security staff that ask you stupid pointless questions and what you do for a living.
For example, on our last trip (which I didn't want to go on, but a relative had just died, and there was a service):
We didn't have all the technical details of where we were staying at every point in our trip - we didn't need them - but they detained us because we didn't have them. They then directed us to a computer and let us *Google for them*. We filled out the details and they let us on our way. I have no idea what the point in that was. I could have named any hotel chain in a nearby city and said "oh yeah, that one", it's not like they called to check.
You certainly can't expect to turn up and just "take each day as it comes" as they expect you to say exactly where you will be and where you are staying. Personally I like to be spontaneous and free wheeling while I'm on holiday - especially when I'm visiting somewhere like the US where there is so much to see. On the last two trips I did multiple flights internally too, that was also an unbelievable hassle. Even the major airports are not designed to have large queues like there are now - clearly waiting areas and shopping areas have been altered to turn them into giant queuing zones.
Of course there are queues at UK airports and some silly rules (e.g. flying from Heathrow to a domestic airport requires you take off your shoes, but fly back to Heathrow from a domestic airport and you don't have to) but the delays don't seem any worse than pre 9/11, especially now that new faster facilities are available. The security staff are by and large pretty chilled out. I've heard of some abuses by immigration officials specifically (who seem to be hired primarily on the basis of how much they hate foreigners), but I've also seen them shrug off abuse and being ranted at at by drunk passengers late for a flight for having to wait all of 10 minutes to go through security (from guys who were quite obviously in the bar when they should have been checking in).
I'm looking forward to a future administration sorting this mess out and restoring some semblance of normality, I just hope that happens sooner rather than later. I know the US economy is a behemoth but the current regime has got to be hurting trade and tourism and impacting on the bottom line (I'm sure it's denting consumer confidence too, and so helping to depress the domestic market).
Or you could just go to a phone booth, call the airport, say that you've planted bombs in the airport, hang up and walk away. Your friends could help by firing firecrackers close by.
Forget magic. Any technology distinguishable from divine power is insufficiently advanced.
No, this is just a symptom of the biggest problem, which is that the people at the top are completely clueless.
Check out this article which shows just how bad it's getting.