Slashdot Mirror
Securing Your Notebook Against US Customs
Nethemas the Great points out a piece from Bruce Schneier running in the UK's Guardian newspaper with some tips for international travelers on securing notebook computers for border crossings. A taste of the brief article:
"Last month a US court ruled that border agents can search your laptop, or any other electronic device, when you're entering the country. They can take your computer and download its entire contents, or keep it for several days. ... Encrypting your entire hard drive, something you should certainly do for security in case your computer is lost or stolen, won't work here. The border agent is likely to start this whole process with a 'please type in your password.' Of course you can refuse, but the agent can search you further, detain you longer, refuse you entry into the country and otherwise ruin your day."
Set up a Windows partition and a Linux partition, set it to boot to Windows by default, keep all your data on the Linux partition. How well would that work, I wonder.
...that your desktop is the Goatse guy and you have 14 videos of horse porn set to auto-play the moment your laptop gets opened. If you're going to snoop through my stuff in public, then the whole terminal is gonna get their money's worth, you fascist bully-boys.
http://www.truecrypt.org/
* Creates a virtual encrypted disk within a file and mounts it as a real disk.
* Encrypts an entire partition or storage device such as USB flash drive or hard drive.
* Encrypts a partition or drive where Windows is installed (pre-boot authentication).
* Encryption is automatic, real-time (on-the-fly) and transparent.
* Provides two levels of plausible deniability, in case an adversary forces you to reveal the password:
1) Hidden volume (steganography â" more information may be found here).
2) No TrueCrypt volume can be identified (volumes cannot be distinguished from random data).
* Encryption algorithms: AES-256, Serpent, and Twofish. Mode of operation: XTS.
Make a folder called "Terror Plans" and fill it with images of cute, cuddly kittens.
FOXTROT UNIFORM CHARLIE KILO
I got it in my biweekly dose of Cryptogram and found it disheartening. The GOD of security says: all you can do is make sure they wont find anything that will mess you up.
The sad thing is that citizens think this idiotic idea of checking laptops at airports serve any kind of law enforcement objective other than generalized panic and further diminishment of democratic values such as the right to privacy.
This is your government fucking people up (and "people" can be foreigners or locals entering the country), attempting to find in informations traces of delincuent activity that, if youre a two bit moron you know you can save it anyhow, in a mostly anonymous fashion on google's, yahoo's or microsoft's servers for free, and any number of services that are available today.
True criminals simply have huge botnets and hidden servers behind the huge pr0n/spam nets and they DO NOT carry incriminating evidence with them and EVEN IF THEY DID, how in hell is a custom's agent going to find them?
I mean, i have a better solution than that of bruce: change your initab so initdefault is 3, make sure that that level does NOT turn on the wifi card or any networking at all, change your shell to ASH (hopefully temporarilly) and let them have the root password, who cares.... good luck, mister customs agent.
NO SIG
The downsides? You probably won't be able to work in the airplane, but is it worth it now that the Customs are being so much trouble?
It's actually because I need to load a device management driver that overrides the BIOS data for the hard disk, but it may actually be worth it for them to try to fiddle around at the MS-DOS prompt...
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
I quit flying a couple years ago after being repeatedly hassled by TSA troglodytes. Looks like I may never get to fly again. Maybe if enough of us stop flying, the airline industry will set its lobbyists to get this fixed. Chances are slim though. Why lobby to get your customers back when you can just lobby for handouts?
That is what TrueCrypt is for (but don't encrypt the entire drive). Just encrypt what needs encryptin'. Set up an encrypted volume with a shadow volume inside a regular file. Call it something that looks like a system file like MSDOS.SYS or DBLSPACE.BIN or something. (That would explain the unusually large size of the file.)
So first, they would have to know you even have something encrypted (which is just a guess if they see TrueCrypt installed). Then they'd have to know what/which files was/were encrypted (which can't be determined by examining the file). Then they'd have to ask you to mount the volume and provide the password (at which time you then provide the shadow volume password, which only contains innocuous files).
I can't be the only dummy to figure that out.
"They said I probly shouldn't fly with just one eye," "I am Bender. Please insert girder."
Can customs officials refuse entry to an American Citizen? Can they banish me for refusing to divulge my password?
Maybe depending on the amount of data you have you could store it onto a CF/SD card and put it into your camera? There has to some way of storing the data on the memory card so that the camera will not see those files but still leave enough space to take a few shots of the customs agents.
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
They can also image your drive. As Bruce says, the easiest way to avoid this is to not have your data on your laptop. Put it on something else.
You can bet that before I type my password for a customs agent, I'm going to talk to my company's legal department. And I'll wait in the customs office as long as it takes. Or simply forfeit the laptop and put it in the trash.
The IP on my laptop is easily worth 10x more than the value of the laptop itself.
--
$tar -xvf
Imagine the pre-computer days, when the customs could stop you, do a naked search and go through all your papers without any passwords. What could you do at that time? Just do not take the sensitive papers with you or mail them with certified mail.
I think there is no difference now. Email your files and do not put them on your laptop. That is what TFA is basically saying too.
So, IMHO, complains here won't work. The only problem that travelers have with laptop/cellphone search is inconvenience (since everybody is used to store all your files on your hard drive), but otherwise it is not any bit less legal than it was before the laptop era. And inconvenience is not any concern for authorities at all. So consider your laptop to be your briefcase and just not put any documents there that you don't want custom officers to see. End of story.
Having returned from my second trip to China, I still find it amazing that it is easier for me, as a foreigner, to enter China than it is for me, as a US citizen (born a US citizen to parents who were US citizens, etc.) to enter the US after a trip abroad.
I just pretty much walked right through in China - I handed them the entry form (one half of the two part form - the other half you give them when you leave) and they waved me through. Customs in China did not even ask to see my laptop, never mind read files or anything like that.
On returning to the US at Detroit International, I was given the 3rd degree by US Customs agents, and I'm a US Citizen. "How long were you in China?" (as if he couldn't tell by the side-by side entry/departure stamps in my passport) "What were you doing there?" (visiting friends) "What do these friends do for a living?" (A couple of college professors and a financial analyst)
This happened on both of my trips.
And I noticed that they were doing this to EVERYONE, not just me. (The plane had several hundred people on it.) I'd hate to see what they were doing to Chinese citizens entering the US.
I hope they realize that they are going to scare businesses away from the US if they keep this up.
I find it somewhat ironic that the captcha for this post is "undergo".
I have been denied access to countries for less than not providing a password. They can pretty much turn you away because they feel like it.
"In America, first you get the sugar, then you get the power, then you get the women..." -H. Simpson
Some of today's higher end laptops have easily removable Hard Drives (some multiple drives). It shouldn't take more than a minute or two to replace a functional secondary HD for Customs, and have the other drive tucked into your bag.
Though, they'll probably protest the phillips driver you'll have to carry to accomplish this, because you know that is a dangerous weapon.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
You see? You see? Your stupid minds! Stupid! Stupid!
No doubt they just install a rootkit/keylogger on your box after ripping your HD so after you leave their rootkit calls back and gives them your truecrypt passwords. Don't use a laptop you've lost sight of.
What is it with layered approaches? Is it because it works from cakes to network security?
Yes it's wrong to buck the system and cause trouble for other people.
However, I advocate cooperation simply because conniption causes more porblems than it solves. I would protest this however I could, legally, by picketing or voting or radio station callins.
Just because it's wrong to buck a system doesn't make the system right.
We have a bill of rights for a reason, and getting all panicky and security crazed is just going to let someone powerful step in and take over.
If you give up your freedom, you invite a tyrant. Trusting the government to do everything right only works with saints, which humans most definitely aren't. It's why we have checks and balances.
Have all your US and overseas clients meet each other in Toronto, Vancouver or anywhere in Canada for that matter.
Undetectable Steganography? Yep, there's an app fo
My Mobile phone has a 4Gb flash card the size of my little fingernail. If I had any files that I didn't want customs to see I'd keep them on there and hide it somewhere they'd never find it. Come to think of it I'd probably never find it once I got there. :)
There are a couple of ways to hide your data; one is to have two Truecrypt volumes, one hidden and one standard. This is easy, but it still lets the customs agent know you are using Truecrypt. This may not be a problem in the US (right now) but what about other countries where simply knowing about a program like Truecrypt could look suspicious?
This post on the Truecrypt forums describes a way to install two OSes, one for show, and one hidden. Unless there is a Truecrypt rescue CD or bootable USB thumbdrive inserted the system will boot to a normal Windows desktop. This method would hold up to any casual sort of inspection, such as those customs agents carry out dozens of times per day. There are a couple of traces that would need to be removed in order to actually have "plausible deniability", but to me not having the questions asked in the first place is preferable to being able to deny one of the potential answers.
It's sad that you might need to do things like this, but there are often technological solutions to social problems.
"He's more machine now than man, twisted and evil."
Things like privacy are sacred to some people, and unimportant to others. People who advocate that they have nothing to hide is all well for them, however it does not apply to every single person in the world.
And it does not necessarily have to be work related, or something proprietary that can be stolen and sold for cash. Perhaps it is embarassing information on the person, private pictures of family, or something else that is legal and legitimate to keep private. If you have no problem forceing big brother on yourself, that is ok. That just doesn't work for everybody...
Those who live by the sword, get shot by those who live by the gun...
This amendment exists to protect citizens from a government that may object to the content they create or possess. Maybe someone can explain why the act of entering the country nullifies my constitutional rights.
An even better approach would be to have just a Windows partition. Then do your real work under Linux by booting from a memory stick. If you want to get really paranoid, you could keep all of your sensitive data on a separate, encrypted memory stick, camera memory card ("hidden" in your camera), phone memory card ("hidden" in your phone), etc.
Of course, you should go ahead and do some unimportant work under Windows. Play games, surf the net (safe, unimportant web sites, only, of course), keep your golf scores, etc. That way, if somebody ever does search your laptop, it won't look like a system that's just been wiped to avoid generating any evidence.
There's no point in questioning authority if you aren't going to listen to the answers.
My own opinions on your blinkeredness shall remain unsaid. I'm sure you can guess them.
First, I'm not American. I have visited but these incidents literally remove the country from the list of viable or "safe" foreign countries I could travel to.
"I carry corporate source, designs and some customer data on my laptop. Yes, it would be a problem if it were made public. I encrypt it, but do not hide it. I see no reason that a border guard, a TSA guard or even the (whisper) NSA would choose to give it to a competitor if they had it."
-Several thousand dollars.
- Industrial espionage.
Even in the UK, some staff at airports have been caught selling on items stolen from baggage, there's nothing to stop a corrupt official doing so. By giving them to ability and "legitimate" reason to search ANY laptop for ANY reason, it's inviting problems.
- A letter from Microsoft offering a reward for non-licensed or pirate software.
- Anything that could accidentally tag you as a terrorist.
Customs officer browsing through my web history: You read wikileaks lately? We'll have that as evidence of, in your own words, being an anarchist.
- THIS POST. Say I took a laptop with a copy of my posting history to slashdot to the US... they could EASILY use this very post against me. Evidence of "wanting to avoid customs" or some such rubbish.
"What's the problem here? Is this a matter of principle or is there something to hide?"
Neither. It's my data. You have no right to go through it without reasonable suspicion FIRST. And then in a certified, supervised way to ensure you keep within your stated use of the data. No other civilised country in the world currently does this and the UK has been dealing with terrorism for FAR, FAR longer than the US has (a UK airport security expert was told that he was "being paranoid" before 9/11 when he visited a US airport and complained about their lax security - within days he was on BBC News recounting the tale because 9/11 happened).
My workplace cannot even throw a hard drive out with having it professionally destroyed, whether it's been exposed to confidential data or not. What makes you think I can let a customs officer copy it without MASSIVE assurances of everywhere the data could end up? The chances are I'd be in a questioning room while all the copying was going on.
"Consider how important your data is to a customs official. News flash: I'd bet a lot that they don't give a rat's ass what you've got, as long as it's not illegal. If it's illegal, then the problem is totally different and you have no right to complain about it."
Define illegal. I think you'll find it depends on jurisdiction, for a start, and includes such things as data protection laws. This is the problem.
As a business, I would be required to NOT TAKE SOME DATA into the US because of this - UK and EU data protection laws means that I *can't* let anyone see it, whether or not it's "secret". If your salesman is going to have to break British law to make a sale in the US, then he's not going to GO to the US. Or he'll have to take the steps mentioned in this article.
Say my office gave me a laptop with copy of Windows that was installed from a pirate key... that's "illegal". I could get detained *without reasonable suspicion* and possibly convicted because of that. Say I *don't know* the password to an "encrypted-looking" file on the laptop (like, I don't know, say a database contained within a business program accessed only by Word macros or company-created utilities - I have seen many such systems loaded on laptops for employee use). I'm detained until I release it.
It's not that I have anything illegal under US law - the US is not the world, though. Things that the US does are considered illegal in other countries. Let's not go too far down that avenue because it's just too easy to get into country-bashing.
It's that the US customs have no reason to demand inspections without reasonable suspicion. They certainly s
I would say that most sovereign nations have the power, not the right, to control who and what enters the country.
Because legally you have not entered the country until you pass through customs. Up until that point you are in international waters, so to speak.
If you're not here, you're not under the jurisdiction of our laws.
Browsing at +1 - no ACs, I ignore their posts. So refreshing!
Some would say we have arrived long ago, but this is certainly a telling mark.
We are discussing "hiding legal and unincriminating" stuff so that we don't get hassled by government police. We have gone far beyond the "if you don't have anything to hide, you have nothing to fear" argument where now, even when you don't you have plenty to fear... in this case, potential loss of ability to work!!
They have been going too far for a while, but this is a point at which even the most common person can appreciate and understand the problem with this.
If the EFF were buying "public awareness" ad time on TV, radio and print (I haven't seen any if they already are) I'd donate $100 each month from now until "we've won" whatever that means. I'm sick of this.
Because
We have a whole plethora of words at our disposal with which to convey subtly nuanced meaning and/or sound like pompous gits, depending on the gravity and artifice of the situation. Why, the sheer range of verbal and literary shenanigans available to us is both rejuvenating and invigorating -- allowing us to express ourselves through many permutations of linguistic machinations.
I suppose we could go the 1984 route and strip out all of the words for which people think there is no longer a valid purpose. That way we'd all come down to a nice, easy level of communication, and eventually strip certain kinds of thoughts from people.
In the meantime, some of us will reinforce the veracity of our arguments and interactions with our more polysyllabic linguistic choices to more adequately articulate the lucidity of our positions on topical considerations.
Cheers
Lost at C:>. Found at C.
IANAL.
Because technically it doesn't. You said it yourself:
I changed the emphasis, but as you can see the 4th amendment only protects you from unreasonable searches. Most people believe that searching a person's belongings before granting entry into a country is a reasonable search.
These comments are my own and do not necessarily reflect the views or opinions of my employer or colleagues...
Does that mean I can shoot the border agent and not be prosecuted under American laws?
:-)
Try not to confuse 'legal fictions' with reality
Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
ipods. I mean, come on, they're nothing more than several dozen GB thumbdrives, you can easily put all your stuff on there and carry it with you without suspicion.
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
Put all your important data on one of these - or better yet, don't rip the cable up - leave it alone so it looks like any other cable.
When information is power, privacy is freedom.
This is exactly it.
America is just now doing this? I was returned from Canada and they searched my luggage, laptop, read private conversations, opened letters all cause i was going to be staying 2 months which was too long of a vacation/job for them apparently. The guy was just a prick and didn't want anyone taking jobs. Canada is terrible for this but on Slashdot everything is the big bad USA. I'm so sick of the slant on slashdot. All countries do this its their right to refuse what type of people in their country. Some agents turn away illegal Mexicans cause they're scared of them taking jobs, some customs agents dont like the idea of a foreigner getting paid more than them.
-- "of course thats just my opinion, I could be wrong." --Dennis Miller
[theory, of course]
What is this, people? Waving flags screaming "I'm hiding something!"
If I actually had something to hide, say, key NDA-restricted docs, and I HAD to carry them on me, I wouldn't put up red flags like obvious encryption or a partition with some weird-ass hippiecommie suspicious linux install. If you want to fly below radar, you need stealth.
First: a vanilla install of windows or macOS. Standard business apps, standard documents folder with typical usage, such as correspondence, presentations, expenses, etc.
Second: family photos. Friends on vacation, etc. Make them more than typical: lots of them, and innocuous. If you're too straightlaced to keep personal stuff on your computer, that's suspicious too.
Third: on a different computer, encrypt your files with decent encryption, AES or something, using strong password. Make sure the file name isn't interesting. Doesn't matter, if a professional gets the files, they'll be cracked; the point is to keep them unobserved, so this part's kind of optional.
Fourth: mask them inside innocuous files like the photos. Transfer them to your laptop. Now you're camouflaged. Smile, respect, make eye contact, be naturally a tiny bit nervous but with nothing to hide.
The secret to security? don't get caught.
[/theory]
Damn those pesky terrorists
Next time your laptop breaks down leave the country and come back in and let the TSA figure out whats wrong. Better yet just to screw with them every time you go out of the country buy a cheap busted laptop and carry in though customs.
He gives one piece of very bad advice, on the subject of keeping your data on a big memory card and keeping it in your wallet. He says:
'If someone does discover it, you can try saying: "I don't know what's on there. My boss told me to give it to the head of the New York office."'
Never ever lie to customs guys. If they ring your boss and he denies it, or if you later change your story and say "oh yes, that's really all my files", or if you can't instantly give the address of the fictional 'New York office', then you better start relaxing in preparation for them gloving up to see if you are hiding any other memory cards.
Same with hidden partitions. If, by sheer bad luck, you do encounter a tech-savvy customs guy and he says 'have you got any hidden partitions on here?', say 'Yes'. Better than saying 'No' and having them find out later.
I'm not saying roll over and give them everything - you have rights - just don't lie.
You are certainly right that entering any country can be an interesting experience. Some years ago as a Brit I re-entered the UK and was waived on, by a male customs officer, thru the green passage. A female voice from behind me called out "Stop". I complied and asked why she was giving contrary intructions to another officer? She simply told me "I am in charge". Cut the story short, this female customs officer tore all my baggage and suitcases apart for 1 1/2 hours in a desperate attempt to justify her "suspicions" to her lower ranks. Eventually she decided I owed TWO POUNDS duty, on a minor gift. As I was attempting to put my belongings in order, which were by now strewn over a wide area, she demanded payment. I pulled out a 50 pound note from my wallet and handed it to her apologizing for my lack of small change. She turend and walked towards a door with the money. I called out "Stop" and she turned with a very annoyed look on her face. I said "Excuse me, but your lack of trust of me has been very evident, so you will foregive me if I have similar reservations towards yourself. Please sign this piece of paper saying you hold my 50 pound note and will return with 48 pds change". She turned red with anger, but complied. Meantime the rank and file officers just about fell apart and all ran away rather than laugh out loud. Yeah I know I pushed my luck. But I had retained my cool for 1 1/2 hours while being treated as if I were the worst form of low life..... I also knew I had nothing to hide. Trust is a two way thing anyway. The moral of all this is that when entering ANY country you are and can be subject to officials who have "god" like powers. And there is little one can do but smaile and be responsive and stay cool for as lonmg as possible.
I have many stories of entering countries. Ask me about Dubai in 1980 someday..... Well I flew from New York to Paris on business one day and arrived early morning. I had been somewhat rushed leaving the house and had grabbed my UK passport on the way out of door. So at immigrations I place my passport on the table for the immigration guy. He opens it and grins for a moment pushes it back to me and says. Take a look! I do and open it. To my horror the first thing I see is a picture of my very young daughter staring at me. In error I had picked up her passport. Fast fwd. I get politely lead away to a corridor and asked to sit and wait. About 20 minutes later an aristocratic looking man around 30, in slacks and blazer turns up and leads me into an interview room. He says "Do you speak French". I say: "Not enough to handle this situation!". He smiles, look at the passport and smiles again more broadly. "Ian, he says, I am NOT your problem. Nobody would try to enter France illegally this way. You are free to go now". "Thanks" I say. "Don't thank me he says, think about how difficult it will be now for you to leave France. Good luck" He was right. The Britush Embassy also fell part with laughter at my story. Everyone appeared from counters and doors to hear the oft repeated story. I finally resolved the situation by having my real passport couriered to my hotel. Check ALL important documents B4 travelling, it really does help. And if you mess up, find officials with a sense of humor.....
Obama bin Laden must orgasm every single night at how
My vote for the typo of the day!.sig: No such file or directory