Take the 2-minute tour ×
Travel Stack Exchange is a question and answer site for road warriors and seasoned travelers. It's 100% free, no registration required.

When I successfully (legally) immigrate into the USA, I had to move some of my computers which contain a client's sensitive data/project.

I was surprised when I found an article that says the CBP have the right to scan a computer (and can force me to enter the truecrypt password!)

I am unable to wipe any data, but leaking extremely sensitive data is a big problem for me (What should I say to the client, "the government wants your project"?)

I swear that I am not a terrorist of course, but I want to know what other businessmen do in this kind of situation.

share|improve this question
10  
btw. wouldn't this question be better fit for security.SE? –  vartec Dec 11 '13 at 13:17
1  
@vartec +1, not sure if it's a better fit here or there but some aspects of the question (e.g. the technical details of how you should put your data in the cloud or retrieve them) would clearly be more relevant on the other site. –  Relaxed Dec 11 '13 at 13:26
4  
Do you know about hidden volumes? In a nutshell, you can hide the data on the drive and have it look like there's no data there at all. Usefull links: truecrypt.org/docs/plausible-deniability truecrypt.org/hiddenvolume truecrypt.org/docs/hidden-operating-system –  ike Dec 11 '13 at 15:02
    
I hope it is understood that import and export laws apply, and it may be completely illegal to import/export data from one country to another (especially where encryption) for profit. (obviously depending on the data and the countries). This would apply to downloading info from the cloud as well as manually carrying the information with you. –  Xantix Dec 12 '13 at 5:23
2  
You should have a read of this question on Security: security.stackexchange.com/q/11612/485 –  Rory Alsop Dec 12 '13 at 10:17
show 1 more comment

6 Answers 6

Disclaimer: IANAL

Allegedly if CBP officers find something clearly marked as "business confidential", they may not proceed without authorization of higher-ups.

Guidelines have been described in document DoHS's document "Privacy Impact Assessment: CBP and ICE Border Searches of Electronic Devices". Seems that according to this if CBP officers would disclose any of your trade secrets, they'd still be legally liable.

However, if you don't want to take chances with that, the recommended course of action is (for example for foreign lawyers):

  • use high grade encryption and upload encrypted files to a cloud
  • store (pass-phrase protected) encryption keys on small device (eg. microSD card)
  • sanitize your computer deleting sensitive data and encryption keys
  • download and decrypt your data as needed

Note, that this is going bit on paranoid side of things.

share|improve this answer
    
On the receiving end, internal CBP procedure hardly makes any difference at all. The agency and beyond the agency the US government as a whole can still search computers, require passwords or decryption without any specific justification or due process. –  Relaxed Dec 11 '13 at 13:22
    
@Annoyed: true, but just because they can doesn't mean that it's something average Joe will experience. –  vartec Dec 11 '13 at 13:34
    
Sure (I wrote as much in my answer, incidentally) but that was the case anyway and it's totally unrelated to this detail of the procedure. –  Relaxed Dec 11 '13 at 13:57
add comment

A random search of your computers seems very unlikely but what I read also suggests that you have basically no legal recourse against it should it happen. The only workable solution I am aware of is to upload the data somewhere and then download it once you are in the US.

Of course, this creates all sorts of new security issues (how to secure the transfer and server against whatever risks you are concerned about, etc.) but it would prevent border guards from accessing your data without doing anything illegal. I have no idea if many (business)people actually go to the trouble of doing it.

share|improve this answer
3  
For travel outside the US my employer issues loaner laptops that don't have any data on them beyond the bare minimum needed for the trip that can't be VPNed on arrival; but AIUI they're more concerned about theft/loss than being snooped on at the border crossing itself. –  Dan Neely Dec 11 '13 at 14:36
add comment

One possibility is to do a full drive encryption with some software like TrueCrypt. You can then store the key on a USB drive and have someone you trust send it to you once you make it across the border.

This way you are physically not able to decrypt the computer if asked/forced to. Make sure the thumb drive only gets sent to you once you're safely across the border. The only problems in this would be if the government made a copy of the encrypted data and then intercepted the drive in the mail.

Another alternative is to have a friend encrypt the key and upload it to the cloud. They could then tell you the password once you're safely in the US.

share|improve this answer
    
With TrueCrypt you can also encrypt a "file", which is really just a container that stores whatever files you want to encrypt. From there you can also have two different passwords. One that reveals one set of data, another that yields a separate set. So if forced to provide a password you can provide the lesser of the two: plausible deniability. TrueCrypt is great for the international traveler with sensitive data. –  radpin Dec 11 '13 at 21:01
4  
If it really comes to it, not being able to decrypt content might just result in even more trouble, possibly confiscation of the material or detention. Computer-minded people love elaborate technical counter-measures but it really does not matter how they work, it does nothing to get you out of the predicament created by the fact that you have no right not to share your data and no recourse against border guards' demands. –  Relaxed Dec 11 '13 at 21:35
add comment

Although I wonder what could be so demanding to import an entire PC (a desktop) - I think there literally are no options if the CBP is bent on checking whatever you are bringing in to USA. Including the nuts and bolts that hold your PC.

I have shipped external hard drive(s) (VM images) in the past and FedEx/UPS had no problem delivering to and from third world countries. I have moved in and around the world freely with a couple of laptops in my backpack with no problems and no inspection at all (other than running them through the airport security scanners).

I feel at the maximum the CBP fellas will wanna inspect whats in the CPU tower versus what is in the hard disk. If the information isn't a terabyte you could also temporarily move the information to a pen drive. I have never heard someone's laptop of pen drive being perused for data.

share|improve this answer
add comment

From our related question on Security Stack Exchange:

tylerl's top answer mentions EFF recommendations:

  • Carry as little data as possible over the border.
  • Keep a backup of your data elsewhere.
  • Encrypt the data on your device.
  • Store the information you need somewhere else, then download it when you reach your destination.
  • Protect the data on your devices with passwords.

...US Customs policy giving themselves permission and responsibility to examine all incoming devices (and data on these devices), including computers, cell phones, etc.

...a number of cases of Customs officials placing monitoring/tracking software on transiting computers

...Finally, don't forget the value of Truecrypt hidden volumes. The plausible-deniability is helpful when dealing with governments.

And I would suggest that these are not activities limited to paranoiacs, but should be followed by any business-person travelling to the US. I don't take any devices with business data on if I can help it, and where possible I also avoid taking personal data.

share|improve this answer
add comment

You might be interested in reading this article. http://www.cba.org/CBa/PracticeLink/tayp/laptopborder.aspx

"Once at their destinations, employees work with data stored on company servers via secure virtual private network (VPN). (Secure connections are a must since, under certain circumstances, U.S. law permits interception of e-mail and remote server connections.) Employees may download files to their computers, upload the results of their work to company servers and “forensically clean” their computers before traveling again."

share|improve this answer
    
Considering the recent events regarding operations of NSA and other US agencies the statement "U.S. law permits interception of e-mail and remote server connections" is at least debatable. –  Simon Dec 12 '13 at 8:39
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.