Slashdot Mirror
Whitehat Hacker Moxie Marlinspike's Laptop, Cellphones Seized
Orome1 writes "The well-known whitehat hacker and security researcher who goes by the handle Moxie Marlinspike has recently experienced firsthand the electronic device search that travelers are sometimes submitted to by border agents when entering the country. He was returning from the Dominican Republic by plane, and when he landed at JFK airport, he was greeted by two US Customs officials and taken to a detention room where they kept him for almost five hours, took his laptop and two cell phones and asked for the passwords needed to access the encrypted material on them."
They are all under the umbrella of the Department of Homeland Security whose core mission is to annoy, harass, and humiliate law-abiding citizens while letting the crooks slip through the cracks.
In short, federal policing powers given to the creme de la crap.
I'm still not sure how this doesn't violate the Fourth Amendment. Customs has the right to view your belongings for *safety* reasons, and to ensure that the items you are carrying are not contraband. Does code constitute contraband now? Can you be arrested for having code on your machine? I'm not talking about copyrighted, installed programs.... if something is encrypted, isn't that the same as having a secret in your mind? You know they dumped his drive, but the main question is whether they're allowed to. Isn't that stealing from the passenger then?
Generally, I agree with the mission of customs, inspect stuff coming into the country. But it does not take 5 hours to do so for some guys laptops and a person should not be required to hand over passwords to their own computers.
If the govt. is interested in you, it's going to be interested in your computers and cell phones. Makes sense, right? So if you don't want the govt. diddling your electronics, don't carry them on airplanes or across an international border. Isn't that pretty simple? The alternative is to have multiple sets of cell phones and computers: one set with all the good stuff on it, one set with nothing important on it that goes with you on planes and across borders so the government agents will have something to amuse themselves with when they detain you.
I'd smash it with a hammer.
I would never trust my hardware again once I had handed it over to some customs (or other government agent) goons, and it left my sight. I would rather just remove the hard drive and hand it alone over to them, at least then I wouldn't have to trash the whole thing.
There's really no way to be 100% sure you successfully "re-flashed" the BIOS, or cleaned all hardware as some posters have said they would do. Not to mention: There could be additional hardware installed, 5 hours is a long time...
You could tear your machine apart and inspect it all you want, but it's well known once the enemy has unfettered physical access to a device, all bets are off.
It's about questioning authority. It's about unreasonableness. It's about personal liberty & heavy-handed government. It's about "give an inch and they'll take a yard." (There's more but I hope that's sufficient.)
What one fool can do, another can. (Ancient Simian Proverb)
It's in the on-board flash ROM, so you can't easily wipe or check its integrity. Not only BIOS can be reprogrammed, but hardwares like GPUs, peripheral controllers have its own ROM with complete RTOS in some cases. I have a RAID controller I've got from a junkyard. I noticed it has intel logo on the big chip, googled it and turned out it was a ARM-based single board computer which seemed to be capable of running full GNU/Linux.
I can't think of a single thing that could be carried on any laptop that warrants the harrassment of millions a year.
Even if a 9/11 scale event happened every single year, it would take more than four years to match a single year of alcohol-related deaths in the U.S.
Data has nothing to do with customs. They are overstepping their jurisdiction just to bully people.
An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
Regardless of how long it takes, there is no reason to search laptops at the border. Anyone truly interested in slyly transmitting data across the US border would never be foolish enough to accompany said data on the trip. It is _trivial_ to transmit data undetected into the US (nice to meet you, internet. how long have you been there?); what justification is there for searching laptops in the first place?
The secret to creativity is knowing how to hide your sources. - Albert Einstein
Other than their recently uncovered fetish for porn the intention of customs is good.
The idea of customs looking for data in the 21st century is laughable, have they not heard of the internet? That's where I import my data from.
An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
Then get rid of your computer. Seriously, because something like that you aren't talking half-assed law enforcement agency (which is what CBP is) you are talking national intelligence agency that really, really, wants your shit. Well you think that the only time they could pull something like that is at an obvious stop? Not hardly. They could do it before you ever get your hardware. So you order a new motherboard, they intercept the motherboard in transit, replace it with one they've modified, and on it goes to you.
At some point, you have to realize that it is just not worth it, you aren't as valuable as you think you are, and simply trust that your computer is probably fine. If you jump at shadows as badly as your post suggests, then you can never trust any computer ever that you didn't personally build every part on yourself.
Without people looking for vulnerabilities in SSL and publishing the results there would be other people looking for vulnerabilities in SSL and not publishing, just using them to steal.
Security crackers that publish their results are essential to making sure we are really secure, not that we just think we are.
So, Customs tried to erase all of your data on that drive? (If the drive was in a file system that they didn't recognize, like EXT3 or such, then writing files would destroy data)
Actually, why would customs mount the drive in a way that it could be modified at all? It seems like if they can modify it, anything they found would be tainted.
If I have nothing to hide, don't search me
Furthermore, he was being searched by customs after returning from a know drug smuggling point.
Yes, because certain criminals use the Dominican Republic to trade drugs, it's completely reasonable to assume that this person was involved in such activities. After all, nobody would go there to experience the culture, the cuisine, or the wide, sandy, sun-drenched beaches.
However, let's not forget that this guy is an American. There's more drug trading and murder going on in the US than in the Dominican. Obviously that makes him a gun-toting, murdering, drug lord, like all other Americans. I've seen Breaking Bad. The world would no doubt be a safer place if we didn't let Americans get out of the US.
When our name is on the back of your car, we're behind you all the way!
> legitimate and competent
Really? So harassing someone and stealing their kit in the airport is "legitimate and competent"?
If someone *really* wanted to smuggle "illegal" data of some kind into the country, they wouldn't be daft enough to travel with it on their laptop. They'd encrypt it and email it to themselves; or upload it to a cloud storage service, or have a file server of their own to FTP it into; or dump it into some random usenet group; or any of probably a dozen other ways to move data without physically carrying anything incriminating with them. The fact that this is lost on these thugs kind of blows "competent" out of the water.
That just leaves "legitimate". And I guess that depend on whether or not you believe in the fourth amendment to the constitution or not.
Imagine all the people...
Those who would give up Essential Liberty to purchase a little Temporary Safety, deserve neither Liberty nor Safety. — Benjamin Franklin
Oh, this is easy! We'll just beat you with this rubber hose until you give up the key.
The beatings shall continue until the key is revealed!
Whatever happened to him in the mean time is OK so long as it reaches a satisfactory conclusion?
That's not how I understand the parent poster -- s/he doesn't say it's okay, s/he objects to the sensationalism.
Was the hacker targeted because he was a hacker? If not, why add that?
It's like writing "Melissa's (5) dog hunted down and shot by tax-funded agents after accidental escape!!!!eleven!! Girl in tears!!" instead of "Animal control forced to shoot escaped, rabid dog".
The PP didn't say it is okay that this rule in place. /. need not steep to such lows.
I will state that the way the story is presented leads readers to think that this hacker was a specific target, and by omitting the outcome the text fosters some righteous indignation which remains due to the lack of a conclusion.
In other words (again mine): presenting it this way is "FOXing" the story up. And
Isn't this why you Americans are allowed to have guns? Shouldn't you be overthrowing your government and stopping all this stuff that has been in the news recently?
Regardless of how long it takes, there is no reason to search laptops at the border. Anyone truly interested in slyly transmitting data across the US border would never be foolish enough to accompany said data on the trip.
You would be surprised. Most criminals aren't that bright. Fingerprints have been commonly used for more than a century, and yet many criminals aren't smart enough to wear gloves.
"After all, nobody would go there to experience the culture, the cuisine, or the wide, sandy, sun-drenched beaches."
Doing all that doesn't exclude playing drug mule.
You don't need a password to extract drugs from a hard drive.
When our name is on the back of your car, we're behind you all the way!
It should be noted that the USG has steadfastly avoided violating the 3rd amendment, and should certainly be commended for its restraint in this matter.
Except when it comes to installing spyware on people's computers - the cybernetic equivalent.
The point of "quartering troops" in people's homes was not just the seizure of the homeowners' resources to support the occupying army. It was also that the troops - living with the family, eating at their table, etc. - doubled as government spies scrutinizing all aspects of their behavior and most of their belongings. They destroyed the privacy of the home.
Spyware is the same story: Active agents of the governmental power, resident in the victims' space, supported by their resources, privy to their dealings and information, and reporting it back to the powers-that-be.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
But it's not and until you convince the government to change the laws, those drugs and other things are checked for by customs.
I do not store my documents on my laptop. I store them on my server at home. Log into it? From remote? Can't do that, I'm sorry. I don't need my documents on this trip, to why should I have to access them?
Your turn.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.