A US-born NASA scientist was detained at the border until he unlocked his phone(theverge.com)
theverge.com
A US-born NASA scientist was detained at the border until he unlocked his phone
http://www.theverge.com/2017/2/12/14583124/nasa-sidd-bikkannavar-detained-cbp-phone-search-trump-travel-ban
437 comments
As a EU citizen, I see these events from a bit different angle. I have visited US several times and the atmosphere and behaviour of both the customs officers and the TSA personnel gets more and more overlooking.
I have never went through such extended search but going across a US airport feels really uncomfortable, to the extent I haven't seen in another country (UK comes close, though). The thing is Trump only added a little bit. This is a process that has been evolving for some time already.
I wonder if anything would change if all US travellers to Europe would be given a leaflet explaining:
"As a reciprocal measure for ESTA or Visa process, you are obliged to pay $14 entry fee. Moreover, we will perform an extended search to every fifth American passport holder. During the search, we may seize your devices and ask for your passwords. Not complying may result in a detention up to 24 hours and/or denied entry."
I have never went through such extended search but going across a US airport feels really uncomfortable, to the extent I haven't seen in another country (UK comes close, though). The thing is Trump only added a little bit. This is a process that has been evolving for some time already.
I wonder if anything would change if all US travellers to Europe would be given a leaflet explaining:
"As a reciprocal measure for ESTA or Visa process, you are obliged to pay $14 entry fee. Moreover, we will perform an extended search to every fifth American passport holder. During the search, we may seize your devices and ask for your passwords. Not complying may result in a detention up to 24 hours and/or denied entry."
Here's the Customs and Border Patrol policy in question [0] (see page 31).
The EFF has a nice write-up on this topic [1]. It sounds like there's a "border search exemption" that bypasses the Fourth Amendment. The rationale was to ensure duties were paid and screen for "bad guys," drugs, weapons, diseased fruit, etc.
[0] https://www.dhs.gov/sites/default/files/publications/privacy...
[1] https://www.eff.org/deeplinks/2016/12/law-enforcement-uses-b...
The EFF has a nice write-up on this topic [1]. It sounds like there's a "border search exemption" that bypasses the Fourth Amendment. The rationale was to ensure duties were paid and screen for "bad guys," drugs, weapons, diseased fruit, etc.
[0] https://www.dhs.gov/sites/default/files/publications/privacy...
[1] https://www.eff.org/deeplinks/2016/12/law-enforcement-uses-b...
The crux of the matter is here:
More importantly, travelers are not legally required to unlock their devices, although agents can detain them for significant periods of time if they do not....
and here: The document given to Bikkannavar listed a series of consequences for failure to offer information that would allow CBP to copy the contents of the device. “I didn’t really want to explore all those consequences,” he says. “It mentioned detention and seizure.”
It sounds like CBP is trying to circumvent the "PIN Revealing" need by basically illegally detaining Citizens until they do.
This is grounds for "Habeas Corpus" lawsuit - should a citizen really dig their heels in.
More importantly, travelers are not legally required to unlock their devices, although agents can detain them for significant periods of time if they do not....
and here: The document given to Bikkannavar listed a series of consequences for failure to offer information that would allow CBP to copy the contents of the device. “I didn’t really want to explore all those consequences,” he says. “It mentioned detention and seizure.”
It sounds like CBP is trying to circumvent the "PIN Revealing" need by basically illegally detaining Citizens until they do.
This is grounds for "Habeas Corpus" lawsuit - should a citizen really dig their heels in.
When I was a child (in central Europe), USA was seen as a heaven where everyone would like to live - and I did too. Nowadays I'm very happy I live in a "poor", speaking by numbers, but much more free republic in the middle of the old continent.
Especially with a USG-owned device, this seems like it would have been a ripe time to assert one's citizenship for entry and just let them steal the device.
The last time I traveled internationally, I purposely brought only an old laptop. To return, I zeroed the hard drive and physically removed it from the machine so the scum would have pretext to steal less of my property.
For my preparation I was rewarded with absolutely no thuggery, which is how the sheer majority of border crossings actually go. That's the insidious thing about the inverted-totalitarian threat model - these specific situations are inherently rare. If they were common, change would easily happen through democratic means. It is only through the majority of people believing that it cannot happen to them, are the injustices allowed to persist.
We really need a reboot for a modern OS model which puts cryptographic access control front and center, with support for secret splitting and the appropriate bottom-up foundation that allows for steganographic-secure machines. I can actually see this plausibly happening for proper personal computers, eventually. Unfortunately the average person's computing device has become a "cell phone" which, even ignoring the inherent pwntivity of Qualcomm integrated chips, is a software ecosystem funded primarily through commercial surveillance.
The last time I traveled internationally, I purposely brought only an old laptop. To return, I zeroed the hard drive and physically removed it from the machine so the scum would have pretext to steal less of my property.
For my preparation I was rewarded with absolutely no thuggery, which is how the sheer majority of border crossings actually go. That's the insidious thing about the inverted-totalitarian threat model - these specific situations are inherently rare. If they were common, change would easily happen through democratic means. It is only through the majority of people believing that it cannot happen to them, are the injustices allowed to persist.
We really need a reboot for a modern OS model which puts cryptographic access control front and center, with support for secret splitting and the appropriate bottom-up foundation that allows for steganographic-secure machines. I can actually see this plausibly happening for proper personal computers, eventually. Unfortunately the average person's computing device has become a "cell phone" which, even ignoring the inherent pwntivity of Qualcomm integrated chips, is a software ecosystem funded primarily through commercial surveillance.
There are at least four facts that should cause stuff like this to be discontinued immediately:
— It is not only possible to acquire electronic data after crossing a checkpoint but there are many ways of doing so.
— There is no possible way for the contents of a phone to be a threat to TRANSPORTATION security, which is theoretically the only reason someone should care when you’re crossing a border, boarding a plane, etc.
— Even if it were possible for data itself to be a threat (and it’s not), there are many ways to carry data. Someone could hide the data in encrypted form, or even hide it in plain sight by being clever. Also, the information crossing a border doesn’t have to be electronic at all; it could be a page in a book.
— Even if something “suspicious” is found, that is not guilt and no charges can be laid so what is the point!?
It’s long past time to shut down all of these ridiculous things. There should be a very tiny list of things that border security needs to do, and it should all fit on one hand.
— It is not only possible to acquire electronic data after crossing a checkpoint but there are many ways of doing so.
— There is no possible way for the contents of a phone to be a threat to TRANSPORTATION security, which is theoretically the only reason someone should care when you’re crossing a border, boarding a plane, etc.
— Even if it were possible for data itself to be a threat (and it’s not), there are many ways to carry data. Someone could hide the data in encrypted form, or even hide it in plain sight by being clever. Also, the information crossing a border doesn’t have to be electronic at all; it could be a page in a book.
— Even if something “suspicious” is found, that is not guilt and no charges can be laid so what is the point!?
It’s long past time to shut down all of these ridiculous things. There should be a very tiny list of things that border security needs to do, and it should all fit on one hand.
Another terrifying part of this, is due to the nature of networks, when one of your "friends" becomes compromised, your private message do too. This goes way past national security, and 7 countries.
I have former coworkers from Syria, Iran, and Iraq. They're great people, and are great programmers. I friended them on Facebook many years ago, and now when one of them is caught at a border it's not just their private messages being raided... its my own anti-trump messages.
This needs to stop here.
I have former coworkers from Syria, Iran, and Iraq. They're great people, and are great programmers. I friended them on Facebook many years ago, and now when one of them is caught at a border it's not just their private messages being raided... its my own anti-trump messages.
This needs to stop here.
The former prime minister of Norway was recently detained at the border for previously having visited Iran. Think about that, prime minister of a NATO allied country. The border rules (even before Trump) are whack.
For all of you guys recommending using fake accounts, do remember that right before christmas, Obama administration signed in new rules[1], giving NSA leeway to share their collected data with 16 other agencies, including DHS, which CBP falls under. So you may get caught if you try to pull these shenanigans off. US agencies are no strangers to mission creep when it come's to sharing data, as seen recently in this article from Intercept on how FBI is building a national watchlist for companies that want to have realtime updates on whether their employees have committed any crimes while employed. [2]
Two quotes from the NYT article that I feel are important to have in the back of your head when you plan your fake accounts:
Now, other intelligence agencies will be able to search directly through raw repositories of communications intercepted by the N.S.A. and then apply such rules for “minimizing” privacy intrusions.
But Patrick Toomey, a lawyer for the American Civil Liberties Union, called the move an erosion of rules intended to protect the privacy of Americans when their messages are caught by the N.S.A.’s powerful global collection methods. He noted that domestic internet data was often routed or stored abroad, where it may get vacuumed up without court oversight.
Let's say CBP get's a tool in a couple of months that let's their border agent search up any passenger through the NSA raw data. That search may then produce your real accounts. Let's say they do this before questioning you, and you then provide them with your fake accounts, that will not look good.
[1] https://www.nytimes.com/2017/01/12/us/politics/nsa-gets-more... [2]https://theintercept.com/2017/02/04/the-fbi-is-building-a-na...
EDIT: Removed the part about felony, as that was blatantly wrong.
Two quotes from the NYT article that I feel are important to have in the back of your head when you plan your fake accounts:
Now, other intelligence agencies will be able to search directly through raw repositories of communications intercepted by the N.S.A. and then apply such rules for “minimizing” privacy intrusions.
But Patrick Toomey, a lawyer for the American Civil Liberties Union, called the move an erosion of rules intended to protect the privacy of Americans when their messages are caught by the N.S.A.’s powerful global collection methods. He noted that domestic internet data was often routed or stored abroad, where it may get vacuumed up without court oversight.
Let's say CBP get's a tool in a couple of months that let's their border agent search up any passenger through the NSA raw data. That search may then produce your real accounts. Let's say they do this before questioning you, and you then provide them with your fake accounts, that will not look good.
[1] https://www.nytimes.com/2017/01/12/us/politics/nsa-gets-more... [2]https://theintercept.com/2017/02/04/the-fbi-is-building-a-na...
EDIT: Removed the part about felony, as that was blatantly wrong.
I don't see what this has to do with Trump's travel restrictions, other than it coincidentally happened at the same time. If the author is trying to imply this correlation is causation, there is no evidence in the article. That being said, no American should have to have his phone searched at the border, even with the stated border exceptions to the Fourth Amendment.
No, the US should not be allowed to request or demand access to a US Citizen's electronic devices for any reason whatsoever, no matter what Homeland Security says. The whole point of customs was to insure that goods were not brought into the country to avoid paying duties. The contents of an electronic device cannot be charged a duty. Anything else is beyond their authority. Of course none of this will stop a guy in a fancy uniform from demanding an illegal search anyway and making your life hell. Given the current government this will only get worse.
> just over a week into the Trump Administration.
It actually started long time before Trump. http://travel.stackexchange.com/questions/3363/laptop-search...
It actually started long time before Trump. http://travel.stackexchange.com/questions/3363/laptop-search...
>"Not only is he a natural-born US citizen, but he’s also enrolled in Global Entry — a program through CBP that allows individuals who have undergone background checks to have expedited entry into the country."
Incredible. The TSA and DHS is basically "theater of the absurd". Every other disturbing detail aside, this individual actually paid good money to enroll in the Global Entry program only to be detained and humiliated by this agency.
Incredible. The TSA and DHS is basically "theater of the absurd". Every other disturbing detail aside, this individual actually paid good money to enroll in the Global Entry program only to be detained and humiliated by this agency.
This is why we need plausibily deniable encryption. Does anyone know an Android ROM, or jailbreak app that is visually indistinguishable from the lock screen, which can be unlocked to an innocuous home screen?
Note to self - bring burner phone for dodgy countries...like the US.
Using detention as a tool to extort access from people is underhanded at best. Rifling through people's digital devices should not be acceptable.
Why doesn't Apple/Google/Microsoft/Facebook et al. coordinate with organizations like EFF or ACLU and throw their weight behind a campaign to stop this bullshit?
If not companies, there's still plenty of extremely wealthy individuals in SV that one would think might care.
Why doesn't Apple/Google/Microsoft/Facebook et al. coordinate with organizations like EFF or ACLU and throw their weight behind a campaign to stop this bullshit?
If not companies, there's still plenty of extremely wealthy individuals in SV that one would think might care.
I work at a military base, I received a background check and everything, not for anything classified, but for a scientific research group stationed on a base. Now, I think I'm afraid to leave the country because I'm not white.
Here I was planning to get global entry, but it's clear it doesn't matter lick.
Here I was planning to get global entry, but it's clear it doesn't matter lick.
All the people suggesting a "duress mode" would solve this issue need to wake up.
For as long as it's not illegal to force people to open up their phones at the border, you are not under duress. In fact, the government could even warp the situation to where you'd be commiting perjury by showing a fake screen.
Unfortunately, we can't solve this problem through technology: we need to convert the broader public and fight to make the representatives we elect work for the people.
For as long as it's not illegal to force people to open up their phones at the border, you are not under duress. In fact, the government could even warp the situation to where you'd be commiting perjury by showing a fake screen.
Unfortunately, we can't solve this problem through technology: we need to convert the broader public and fight to make the representatives we elect work for the people.
> More importantly, travelers are not legally required to unlock their devices, although agents can detain them for significant periods of time if they do not.
What kind of ridiculous technicality is that? Detainment isn't supposed to be a tool to coerce cooperation.
What kind of ridiculous technicality is that? Detainment isn't supposed to be a tool to coerce cooperation.
Obviously appreciating that NASA has some sensitive data but just for a second also try and appreciate how would this play out for someone who works in the financial industry, where unauthorised sharing of sensitive data is not only a breach of contract with your employer/clients but a crime(insider trading) in almost all countries.
Or imagine how the people who enforce these new regulations can exploit this.
Query from the traveller at the border what their job is, if in the financial industry request that they relinquish their email find something that could tip you off and go buy stock. If they don't you lose nothing, you deport them, you do your job.
I understand that you might want to tear this apart, but keep in mind the person that requests your data will often not be the person viewing it, so you are in no position to just "Take some names" and then ensure that your data remains confidential.
This is terrifying.
Or imagine how the people who enforce these new regulations can exploit this.
Query from the traveller at the border what their job is, if in the financial industry request that they relinquish their email find something that could tip you off and go buy stock. If they don't you lose nothing, you deport them, you do your job.
I understand that you might want to tear this apart, but keep in mind the person that requests your data will often not be the person viewing it, so you are in no position to just "Take some names" and then ensure that your data remains confidential.
This is terrifying.
What is the worst that can happen to a non US citizen, who is not producing the passwords they demand?
Being send back immediately and all belongings seized?
Or only devices they do not get the decryption passwords for?
Detainment for how long?
Being charged with what?
Some tweets from @Pinboard feel like they want to go here:
This is a small point but important: don’t specify people are ‘US-born’; either you’re a US citizen or you’re not.
Emphasizing that someone was born in the US as a kind of super-citizenship plays into the hands of people you don’t want to be helping.
The proper term for someone born abroad who doesn’t speak English and has a brand-new US passport is: “American”
This is a small point but important: don’t specify people are ‘US-born’; either you’re a US citizen or you’re not.
Emphasizing that someone was born in the US as a kind of super-citizenship plays into the hands of people you don’t want to be helping.
The proper term for someone born abroad who doesn’t speak English and has a brand-new US passport is: “American”
Now is the time for vendors to consider implementing a duress password. Upon entering your duress password the user is presented with a fake profile, or perhaps everything could just be wiped. I'm not sure how well this would play out in the real world, but it's one of the best things protections I could imagine if you want to carry sensitive data across borders.
This happens in Canada too, unfortunately (was in the news quite a bit not too long ago, and can be seen in action on that reality TV show about border security).
Best to wipe your phone, and not bring any sensitive documents across borders period.
Best to wipe your phone, and not bring any sensitive documents across borders period.
As a white man, I'm a bit concerned about coming back into my own country. The only social media accounts I have are here and reddit. Will the guards at the gate accept that I don't have a Facebook or twitter account?
"You will not share your password (or in the case of developers, your secret key), let anyone else access your account, or do anything else that might jeopardize the security of your account."
https://www.facebook.com/terms
It would be a violation of my facebook terms and conditions to share my facebook password!
https://www.facebook.com/terms
It would be a violation of my facebook terms and conditions to share my facebook password!
This is bullshit. The U.S. should be required to treat its citizens in a constitutional manner regardless of where they are located.
> “I asked a question, ‘Why was I chosen?’ And [the CBP agent] wouldn’t tell me,” he says.
He should file a Freedom of Information / Privacy Act request to get the reason they chose him.
He should file a Freedom of Information / Privacy Act request to get the reason they chose him.
Here's gov data on device searches, from the ACLU https://www.aclu.org/government-data-about-searches-internat...
If you try and cross any border it will be relinquishing access to all accounts.
I'm assuming email also comes along with 'social media', since communication is by its definition social.
So how do you protect yourself? I think just going with "Don't have any social media" isn't a good answer because the relationship that children growing up today with the internet is almost completely different to even people 10-15 years older than them.
Someone having carte blanche access to a person's phone will find something if they want to.
Imagine you're in a few group chats, someone mentions doing some drug. And you've just entered a country where that's an instant prison sentence.
Maybe some off colour jokes about politicians? Proof to kick you out or at least detain.
I imagine we're at the cusp of something much more unsettling. The technology to reverse image search a face is available today. It's pretty easy to make you appear associated with anything, anyone, etc.