Slashdot Mirror


NZ Customs Wants Power To Require Passwords

First time accepted submitter Orange Roughy writes New Zealand customs are seeking powers to obtain passwords and encryption keys for travelers. Supposedly they will only act to obtain credentials if it was acting on 'some intelligence or observation of abnormal behaviour.' People who refuse to hand over credentials could face up to three months jail time. From the story: "Customs boss Carolyn Tremain has told MPs the department would only request travellers hand over passwords to their electronic devices if it had a reason to be suspicious about what was on them. The department unleashed a furore last week when it said in a discussion paper that it should be given unrestricted power to force people to divulge passwords to their smartphones and computers at the border. That would be without Customs officials having to show they had any grounds for suspicion."

42 of 200 comments (clear)

  1. Strong public relations by Futurepower(R) · · Score: 5, Insightful

    Kills tourism to N.Z.

    1. Re: Strong public relations by Anonymous Coward · · Score: 4, Informative

      It won't happen. It's been demonstrated over and over again that people are willing and often eager to comply with the authorities' requests. More likely, other countries will follow soon and the day will come when this is law everywhere. We live in the Surveillance Age now. Deal with it.

    2. Re: Strong public relations by Anonymous Coward · · Score: 4, Insightful

      Fine. We do not believe you, go to jail. When you grow up you'll learn that playing smartass with people who literally own your life is not only foolish but suicidal. You have no concept or understanding of the imbalance of power between you and them, do you?

    3. Re:Strong public relations by ruir · · Score: 3, Insightful

      Oh yes it happens. I have "nothing to hide" but wont travel to parts of the world that do not respect my rights to privacy. What I alone? I sincerely doubt it.

    4. Re: Strong public relations by Karmashock · · Score: 5, Insightful

      You can have hidden encrypted information.

      You're starting an arms race. Cisco is already shipping routers to dead drops in a bid to avoid NSA interceptions.

      The entire tech ecosystem is reacting to increased surveillance.

      The average user you will get it. But person with something to hide? They'll install a bit of encryption software that will not only encrypt the data but make it look like it doesn't even exist.

      And if there is something you have a bogus encrypted file that is decrypted instead.

      There are lots of means of dealing with this stuff.

      --
      I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
    5. Re: Strong public relations by Anonymous Coward · · Score: 5, Insightful

      People like you made Nazi Germany a reality. Good job.

    6. Re: Strong public relations by Anonymous Coward · · Score: 4, Informative

      Well, why not? Getting passwords and checking laptops, phones and whatnot on the border is completely useless waste of time, and won't catch a single criminal or terrorist. People will just travel with clean machines and download anything they need while in the country. What if you don't actually KNOW the password? Company IT department will tell it on the phone to you after you have passed customs? Jailed for 3 months? What if your USB stick contains a "random" datafile? Is it encrypted or just junk? Or some data for some obscure program?

      That being said, people will just travel with clean computers, especially the ones that might have something to hide.

    7. Re: Strong public relations by Raumkraut · · Score: 2

      Privacy is only dead if you are willing to get over it.

    8. Re:Strong public relations by AmiMoJo · · Score: 3, Interesting

      It's even worse for business travellers. New Zealand is already known to do a lot of industrial spying as part of FIVE EYES.

      It's got to the point now where you have to wipe your laptop before travelling, then restore it when you get through customs. Same with your phone. Fortunately it is easy to do both those things these days.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    9. Re: Strong public relations by gadget+junkie · · Score: 4, Insightful

      It won't happen. It's been demonstrated over and over again that people are willing and often eager to comply with the authorities' requests. More likely, other countries will follow soon and the day will come when this is law everywhere. We live in the Surveillance Age now. Deal with it.

      Of course they are. the great unwashed do not see the point, and the others use some form of plausible deniability encryption.
      This is the usual PHB event in which a high official misread some bad science in a hairdresser magazine, asked that something be done about it to an even more ignorant burocrat, and lo and behold, something was eventually done.
      nothing to see here.

      --
      "If a boss demands loyalty, give him integrity. But if he demands integrity, give him loyalty." (John Boyd, 1927-1997)
    10. Re: Strong public relations by Anonymous Coward · · Score: 5, Funny

      Before my next visit to NZ I'll change my phone's password to "fuckyouretardednzcustomsofficers-youimbecilepuppetstotheusa"

      Feel free to use it yourself :-)

    11. Re: Strong public relations by Anonymous Coward · · Score: 4, Interesting

      Way to lay down in the street and die just because some with supposed authority asks you to.

      There's also a third solution: appear to be compliant while retaining your privacy.

    12. Re: Strong public relations by Anonymous Coward · · Score: 3, Insightful

      Better yet, when travelling - the best security is physical security. Don't take important crap with you, keep it on a secure server in your mother country.

      Laptops should be dumb terminals, nothing more.

    13. Re: Strong public relations by Sun · · Score: 4, Interesting

      No, it is not.

      It is a legitimate invocation of a core reason why Nazism was allowed to rule, despite most Germans being against it.

      Goodwin is more about "You do know that Hitler also washed his hands daily". Drawing an analogy that has nothing to do with Nazism.

      Shachar

    14. Re: Strong public relations by K.+S.+Kyosuke · · Score: 2

      Godwined

      You keep using that word. I do not think it means what you think it means.

      --
      Ezekiel 23:20
    15. Re: Strong public relations by dargaud · · Score: 4, Interesting

      Or what if your work actually FORBIDS you to reveal your password to anyone, under various penalties ? I'd like to see a high US official pass through customs and watch a random rent-a-cop get his password and copy all his files. Right, like this is gonna happen.

      --
      Non-Linux Penguins ?
    16. Re: Strong public relations by Gilgaron · · Score: 2

      Not at all: complying with NZ law might make you violate US law, depending on what is on the laptop.

    17. Re: Strong public relations by FrozenGeek · · Score: 2

      And, for good measure, travel with a laptop running BSD without a GUI.

      --
      linquendum tondere
    18. Re:Strong public relations by thegarbz · · Score: 2

      This raises an interesting question: What the hell is the fucking point of searching electronic devices. By their very nature they can send data across the border without a physical interaction with customs. What are they hoping to gain from this? Any illegal activity can already be done from either side of the border including all the usual nasties like terrorism, child pornography, and industrial espionage.

      What are they hoping to gain other than catching a few dumb people which likely would have been caught anyway?

    19. Re:Strong public relations by usuallylost · · Score: 2

      The company I work for now issues people special travel laptops for international travel. They are imaged specifically for the trip with only the applications and data the person needs to do the specific job they are traveling for. When they get back any data that needs to be preserved is pulled off and the machines are reimaged. Things like this and just the general high risk of laptop loss in international travel are the motivations for doing all that. It used to be there was a small list of countries we did that for now their is a small list of countries we don't do it for.

    20. Re:Strong public relations by Anonymous Coward · · Score: 2, Interesting

      The obvious answer is that they're not hoping to achieve anything through this measure - this isn't about the need to compel passwords from people at the border, this is just a stepping stone onto further and far nastier forms of coercion. It's just part of NZ's National government's gradual push towards greater and greater surveillance. Each step is small - each seems ultimately futile - but taken together they gradually reduce our personal freedoms until suddenly we find ourselves in a police state.

      But last election, everyone voted for them. Why?

    21. Re: Strong public relations by Anonymous Coward · · Score: 2, Interesting

      Well, why not? Getting passwords and checking laptops, phones and whatnot on the border is completely useless waste of time, and won't catch a single criminal or terrorist. People will just travel with clean machines and download anything they need while in the country. What if you don't actually KNOW the password? Company IT department will tell it on the phone to you after you have passed customs? Jailed for 3 months? What if your USB stick contains a "random" datafile? Is it encrypted or just junk? Or some data for some obscure program?

      That being said, people will just travel with clean computers, especially the ones that might have something to hide.

      EVERYONE should travel with clean computers. It's just common sense. Also, it takes an "I AM Spartacus" approach to the security theater that does nothing anyway, and inconveniences everyone without a real benefit to anyone. Also, if your machine is stolen, lost, damaged, etc., backing things up before the trip is only common sense, and assuming it will be poked and prodded by government assholes and spies only helps you by forcing you to backup data you know you should anyway.

      The only issue is the re-downloading of content. How sure can you be that the encryption you're using is REALLY secure? You can't, unless you wrote it yourself, and were COMPETENT to write such software. Best of luck.

      Remember: the only truly unbreakable crypto is the one-time-pad, and only if the keys are truly random, truly kept secure, and only ever used ONCE. And even then, you must still be extremely careful, as whenever you let your device out of your site, just assume it's been bugged, had key loggers added to it, etc. You simply can't trust your own technology anymore, since it all came from China anyway...

    22. Re: Strong public relations by TheDarkMaster · · Score: 2

      As a citizen of a shithole country, I am concerned about worse things that border guards can do with my password and full access to my phone. Like planting "evidence" of crimes on my phone and then require a bribe to not arrest me. In these cases the options are shoot to kill, or the best one that is not to travel to countries which have such absurd laws.

      --
      Religion: The greatest weapon of mass destruction of all time
    23. Re: Strong public relations by diamondmagic · · Score: 2

      Encrypted information isn't sensitive, that's the whole point of encryption: To take big secrets (data) and make them little secrets (secret key).

    24. Re: Strong public relations by Karmashock · · Score: 2

      I generally agree, however what if they ask for your server passwords?

      What after all is the difference?

      The trick is to put the information somewhere that they don't know it exists at all. They can't ask for the password if they can't find the files or the server login. You say "what password"? If they can't find the files or the server then they can't ask for the password. And THAT is the trick. Putting the files on a USB stick and then secreting that into your other belongings in such a way that it won't be seen on an X Ray.

      Then they can go over the machine all they want. The data isn't on the laptop. You might even secret the USB drive inside the laptop. There are a lot of circuits in there. Who is going to notice an extra flash memory chip?

      --
      I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
  2. What do you expect to find? by khasim · · Score: 2

    Even if the person is the biggest paedophile terrorist drug-dealer in the world, do you honestly believe that there would be evidence on his phone WHILE HE IS TRAVELLING?

    I don't believe that Carolyn Tremain understands this "Internet" thing.

    1. Re: What do you expect to find? by Anonymous Coward · · Score: 3, Insightful

      I think you're underestimating how stupid some people are.

  3. Decoy by photonic · · Score: 4, Informative

    Easy workaround: dual-booted laptop, one partition with WindowsXP and weak password, full with celebrity porn, 9/11 conspiracy documents and spyware to keep them busy for a while. Fully encrypted Linux partition for everything else.

    --
    karma police: arrest this man, he talks in maths; he buzzes like a fridge, he's like a detuned radio. [radiohead]
    1. Re:Decoy by fustakrakich · · Score: 2

      Why would anyone take anything of real value? The stuff is cheap. Use a throwaway for traveling and upload to a 'cloud' drive during the trip.

      --
      “He’s not deformed, he’s just drunk!”
    2. Re:Decoy by khasim · · Score: 3, Insightful

      Use a throwaway for traveling and upload to a 'cloud' drive during the trip.

      Yes! Do that!

      While you are travelling you are at higher risk for your stuff to be STOLEN.

      So make sure that the thieves (or customs officials) only get hardware.

      Learn how to securely access your files/data remotely.

      Trying to be secretive with hidden partitions and such just runs the risk that you might encounter the one customs agent who knows something about computers. Be boring. Be the most boring person they've ever seen. Have NOTHING of interest to ANYONE on your systems. No pictures/music/movies/anything.

    3. Re:Decoy by Thanshin · · Score: 2

      Easy workaround : Don't go to NZ. There are plenty of beautiful places to visit nearby.

    4. Re:Decoy by sjames · · Score: 3, Funny

      Do have plenty of powerpoints explaining the 1040 long form. That might actually put them into a coma if they look at it.

  4. Standard practice for a department by Harlequin80 · · Score: 3, Insightful

    A department such as customs, police, wellfare etc. will always ask for the maximum possible powers. It is a given. There can be no argument against the fact that a speed camera on every light pole will lower the amount of speeders (either by fear or getting them off the roads). The police therefore will ask for that.

    The role of the legislative body is to control the power of the departments and offset their wants against the negative outcomes of those wants. *Customs* We want everyone's password *Legislature* No, but you can seize equipment and a password may be demanded by a judge.

    The fact that they don't always get it right is a different issue.

  5. "not its intention", hah, hah! by whoever57 · · Score: 5, Informative

    Although the proposed power would let Customs request passwords from any traveller or do random checks on electronic devices, Tremain told a parliamentary select committee that was not its intention.

    Instead, the department would only use the power if it was acting on "some intelligence or observation of abnormal behaviour", she said.

    Protip: whenever some government official says that they won't use their power for some purpose, you know that it will be used in exactly that way or for that purpose. Case in point, RIPA in the UK, which has been used (abused) in cases related to petty crime in exactly the way it was originally claimed it would not be used.

    --
    The real "Libtards" are the Libertarians!
  6. See you in three months by facetube · · Score: 4, Funny

    for i in `seq 1 2160`; do echo "Hello, jail! It's hour $n."; done \
    | gpg -a --symmetric --passphrase "$(dd if=/dev/urandom bs=1024 count=1)" > ~/important.txt

  7. Re:Where's the beef? by facetube · · Score: 2

    "Travellers" includes citizens of New Zealand returning to their homes.

  8. Sigh by ledow · · Score: 2

    Anyone with a brain that doesn't want to have their files read will stick it in a private "cloud" and access it remotely and securely anyway.

    Hell, £100 NAS boxes have this functionality nowadays without any third-party storing the data. Or rent a VPS for the duration.

    The problem I have with laws like this is that you ONLY catch the stupid people anyway. If they are going through customs with a laptop full of "how to beat customs" documents, then they get what they deserve and shouldn't be that professional.

    What you're doing, though, is doing NOTHING to stop an actual, determined guy with half a brain from doing whatever he wants.

    Spend less on junk like this, and just get more passengers a five minute interview to find suspicious people, or spend fives minutes longer on checking the faces, passport lists, etc.

  9. Re:Way to circumvent this. by stephanruby · · Score: 2

    and just have a card in the machine with your music and ebooks to keep you amused on the long flight. (its about 12 hrs from LAX)

    Hopefully, all your music is legal and your ebook titles don't sound suspicious.

    And how many customs officials do they have on duty at AKL anyway? do they have time to go through all 300+ passengers phones/tablets/laptops?

    This can be fully automated. In the UK, I recall they recorded the entire hard drive of your laptop. They said this was a measure against pedophiles, although this policy seems to only have affected a couple of reporters as far as I can tell. They never did this to me when I entered the UK.

    This is in contrast with France.

    At least, the French make a copy of your hard drive when you don't know they're doing it. Waiting until you've left your hotel room, or waiting until you've fallen asleep, is much less obtrusive.

  10. Re:According to the article... by edjs · · Score: 2

    Canadian border agents have vaguely broad powers to search travellers; whether that includes demanding passwords is not explicitly stated and is untested in the courts. That's likely to change, however, as they recently charged someone for refusing to give up his phone's password:

    http://www.cbc.ca/news/canada/...

  11. Re:The real issue by sasparillascott · · Score: 2

    This is totally about storing that password to your phone, PC whatever. You can bet if its not for everyone, its for everyone fingered as a potential troublemaker by the NSA/FBI/Five Eyes accomplices - like privacy advocates. Everyone will just travel with "travel" phones and PC's - something new to work around.

    Looking at what we've learned over the last 2 years and then the statement of what NZ wants to do - makes me wonder if the governments of all (thats the really troubling part, all) the western democracies have completely lost their minds. Nobody has stood up for the privacy of their citizens, and privacy is vital for the long term survival of democracy.

  12. Re:Where's the beef? by facetube · · Score: 2

    New Zealand actually is a signatory of the Universal Declaration of Human Rights, which says that "everyone has the right to leave any country, including his own, and to return to his country", "no one shall be subjected to arbitrary interference with his privacy, family, home or correspondence".

    I don't even know where to begin with the child/parent analogy. The relationship between a ten-year-old and her mom is obviously and fundamentally different than the relationship between a citizen and their representative democracy.

  13. Yes, a lot of people *do* have options by Anonymous+Brave+Guy · · Score: 2

    Alternative theory: I choose not to travel to somewhere where such mall cops have any authority, or where border authorities like to throw their weight around.

    There are more places in the world that I would like to see than I will ever be able to in one lifetime. I choose to visit those where I feel welcome, and they get my tourism revenue in return.

    There are more clients in the world than my company will ever be able to do business with. I choose to work with those in places where doing business is easy, and those places get more business and probably more tax revenues in return.

    Of course there are some people who realistically need to travel to certain places, though I don't think it's nearly as many as the apologists tend to claim and I think the number is coming down as more convenient and much cheaper long-distance communications technology improves. And of course there are some people who are willing to put up with a lot because they really want to visit a certain place. But not everyone who travels is in these categories, and by making travel unpleasant and making a country unwelcoming, in the long run those places will lose out on the rest of the visitors they might have had.

    I recently travelled from the UK to another country in Europe, and chose to go by train. It was significantly more expensive than flying with a budget airline, and of course the travel time itself was significantly longer. But it was so much more pleasant in all other respects than all the hassle that comes with flying these days that I did it anyway.

    The thing I most noticed was that although I was going through several different countries, once I was out of the UK and into the Schengen Area I just got on a train to go from place to place and the fact that it was international was no big deal. And you know what? No-one died in a horrific terrorist incident on the train. The criminal underworld has not taken over half of Europe. They don't seem to have any worse problems with contraband and black markets and illegal immigrants than we have at home. I doubt anyone was sneaking state secrets (or a dodgy rip of the latest movie) out of the country in a USB stick hidden in their handbag. And at no point on the journey did I feel threatened or unsafe because of the lack of overt security.

    In fact, the only times I felt threatened and unsafe on the entire trip were going out of and back into my own country, and that's because we're doing it wrong. But it was still far less unpleasant than flying and all that goes with it these days.

    --
    If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.