9

If I travel to the US and had privacy concerns (for instance may be I was afraid that a rogue customs official may steal said data) what is the current recommended best practice to avoid this?

  • Use a VPN and transfer the data before you go. – Burhan Khalid Oct 17 '14 at 4:31
  • Don't think I have ever seen a custom agent look at what is on a laptop, only have had security ask me to turn it on to prove it was a working laptop. – user13044 Oct 17 '14 at 4:40
  • @Tom this happens more often than you think; a few colleagues had their devices searched. – Burhan Khalid Oct 17 '14 at 4:48
  • 3
    @pnuts may get your laptop confiscated or admission denied - claiming you don't know the password is indistinguishable from refusing to provide the password. – Kate Gregory Oct 17 '14 at 6:27
10

There are cases of customs and immigration demanding the passwords to phones or laptops, and then taking them out of sight of the passenger to use them and search them. Apparently by law you must provide these passwords when asked, and you may not follow the officers around to see what they do with your devices (such as putting USB sticks into them to copy data.)

(For the specific question of "can they really do that?" see

The best prevention for this problem is almost certainly not to have the sensitive data on the laptop at all. It can be in some sort of cloud storage and you can copy it onto your laptop after you clear the border.

The second best prevention is to have the data with you but hidden. People have suggested a dual-boot setup, where the machine is booted into one OS that does not have access to the sensitive data at all, and only if they reboot the machine will they know that another OS even exists. Hidden encrypted partitions have also been suggested. While this may work, if it is noticed it will suddenly make everyone very suspicious and get you a lot more attention, so it may not be worth the risk. You can also use USB devices that don't appear to be USB devices at first glance - I own a beer bottle opener USB and I know someone with a watch USB - to carry the data. While I have seen laptops and phones searched on episodes of Border Security (generally snooping through emails to see if someone is coming into the country to work or to stay forever) I have never seen USB sticks searched, and I suspect USB sticks that don't appear to be data storage devices would be ignored. (I also once carried a bunch of Word documents on an SD chip in a camera, not for cloak and dagger reasons but just to have one less thing to lose.)

Related: https://security.stackexchange.com/questions/88947/prevention-measures-against-laptop-seizure-at-us-borders

The third best prevention is to convince yourself that an officer searching your laptop is searching for:

  • contraband data itself, most notably child pornography
  • proof that your story of where you have been or where you are going (and why) is true or not
  • proof of your immediate future plans or immediate past activity
  • names and contact information of people who can confirm your story or who can be investigated as part of your criminal behaviour

They are not particularly searching for hot stock tips or the news that your company is considering acquiring another, nor the proprietary results of the latest tests on something you're developing. That information may have tremendous value to someone, but a rogue or corrupt customs official is probably more interested in celebrity photographs than corporate intelligence. But if you can't shake your fears, then keep the data off the laptop and if possible entirely off your person as you cross the border.

  • 1
    Uploading sensitive data on cloud storage kinda goes against the idea of safeguarding this data. – JoErNanO May 11 '15 at 15:11
  • 3
    Most cloud services are actually quite safe. But of course you can encrypt what you upload, hide it with steganography, lock it up in a private corporate cloud behind VPNs with dongles, whatever. The point is that if it's not with you, it can't be looked at while crossing the border. – Kate Gregory May 11 '15 at 15:23
6

The best practice is not to keep sensitive and/or business critical data in a portable computer or device. The hard drive could fail anytime, the computer would be lost, broken, stolen. The best scenario is to host the data on any secure counter or server, which would be accessed either thought a VPN as @BurhanKhalid suggested or to be put somewhere in the Cloud and to be accessed from authorized devices only. I hope that this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.