HN

Need help?
<- Back
Returning from vacation? The government can search your phone without a warrant

Returning from vacation? The government can search your phone without a warrant

rbanffy

Comments (232)

  • Tangurena2
    > “In [Fiscal Year] 2025, out of the over 419 million travelers CBP processed at ports of entry, CBP only searched the electronic devices of 55,318 international travelers,” the agency wrote, or 0.0013%.The harassment is targeted at critics & opponents of the current regime. The message is very clear: Be afraid of us. Be very afraidThere are 33 days remaining until election day. Vote out all the incumbents.
  • TrackerFF
    Yeah, people are unfortunately not informed on just how much power border agents wield. Not only in the US, but in many (most I'd believe) other countries, too. I've worked on cases (intel side) where the law-enforcement side would just wait for the surveillance objects to cross the border, as that's where they could do most data collection with the least hassle.If for whatever reason you think you're being investigated or surveilled (who knows for what these days, could be enough to just associate with the various protest groups / orgs), you can just assume that the border will be where they'll try to clone / download your data (phones, laptops, whatever)
  • lbriner
    For me, it isn't the lack of warrant (I am a UK Citizen but I expect we have similar problems here), it is the lack of transparency and accountability.If was arrested on suspicion of something, I can get legal assistance and I can know what I am suspected of and why before any of my property (or in this case, potentially very private and sensitive information) could be taken. If the arrest is manifestly wrongful or not based on any evidence, then I expect it would be easy enough to resist investigation.On the other hand, having someone at the border who can justify an arbitrary search on the basis that "they might suspect of something", without having to clearly justify that basis and that if they then take property (or information), potentially copy it completely opaquely and then have zero accountability if that is misused is extremely frustrating but I guess you need to lobby your lawmakers to make the system fairer and to ensure legal protections of privileged information is completely upheld - period.
  • Cider9986
    IANAL. This is my understanding.For US citizens entering the US: If you're concerned about protecting your data from this threat, you should use GrapheneOS (or less good would be a latest iPhone in lockdown mode and BFU) and not talk to the police. The 5th amendment does not seem to have an exception at the border, so you can't legally be compelled to hand over your password by border agents (there's not strong case law here). They can lie, they can detain you, search you, they can seize your stuff. You shouldn't be the one arguing with them, you should be silent (besides identification) and ask for an attorney (you don't have a right to an attorney at a routine search). As a US citizen, you can refuse and still enter.GrapheneOS has demonstrated to be robust against physical access even in AFU [1]. It's still a good idea to shut down / restart because BFU is much more secure. To maintain convenience while avoiding reliance on the rate limiting of the secure element, you can use a long random passphrase as your primary unlock (you enter it every time the device is in BFU) and a fingerprint with a second factor pin as the secondary unlock.Even if you factory reset your phone and backed up data (to an E2EE cloud provider, over Tor and memorized the credentials), you should still not disclose your password because it could allow evidence to be planted or your device to be compromised. Nothing you say to the border agents can help you in court, it can only be used against you.The duress pin is generally not how you should handle a situation like this. You do not need the duress pin to prevent access, its purpose is if you're being physically coerced as well as to give the attacker the dillema of whether to enter a coerced password (it even gives this benefit for people that don't use the duress password).Sure, if police are behaving illegally and the information that would be disclosed is worth the possible punishment, then that's a personal decision.[1] Based on leaked Cellebrite documentation, GrapheneOS was the best performing device against AFU attacks. It also has a customizable reboot timer to bring the device back to BFU after a set time of not unlocking. The options are between 10 minutes and 72 hours of unlocking and 18 hours is the default iirc. Apple and Google added this to their phones after GrapheneOS without the option to customize. Theirs are set at 72 hours.
  • tantalor
    The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.It's self explanatory.
  • raincole
    > “In [Fiscal Year] 2025, out of the over 419 million travelers CBP processed at ports of entry, CBP only searched the electronic devices of 55,318 international travelers,” the agency wrote, or 0.0013%.And...> In Fiscal Year 2020, CBP processed more than 238 million travelers at U.S. ports of entry. During that same period of time, CBP conducted 32,038 border searches of electronic devices, representing less than .014 percent of arriving international travelers.[1]In other words, now it's as likely[0] to get your phone searched as in 2020. It's interesting how the media shapes people's perspective, isn't it?[0]: 0.001% less likely, so just marginal error.[1]: https://www.cbp.gov/newsroom/stats/cbp-enforcement-statistic... not sure it reports 2020's data here though.
  • gorgoiler
    ”[the CBP agent] said if I didn’t give them my phone, my interrogation was going to take much longer and they could retain my phone indefinitely”I would take a punt at filing a complaint about that. Threatening someone with selective enforcement must fall short of professional standards at CBP, as stated on their .gov page:https://www.cbp.gov/sites/default/files/2024-09/exhibit_08_-...
  • smalltorch
    I don't like this. I think about a year ago when there was a big push for chat control in the EU, almost like an instinct, I started working on ways to be more soverign with my data.I'm just a regular guy who really has nothing to hide, but that doesn't mean I need to be complacent with just allowing a future I don't like be propped up in front of my eyes.What I've come to realize is there is really no safer place for your data and communications than just your own home. At the very least, I would like a judge to review the evidence of my alledged wrong doing before the government can raid my castle and get what they need.Why do I, as a regular citizen feel the need to invoke and create my own protections on personal data and communications?There's something deep inside me that feels the need to be prepared for this odd future where the government feels they have the right to access everything. It's deeply troubling on many fronts.
  • gblargg
    Too bad phones aren't easy to do a full back up of, wipe, then restore after you are past the border agents. Or can keep all user data on a microSD card that you remove and secure before the search.
  • crispyambulance
    I wonder if there's a way for "targets" of CBP to easily maintain phones that can be toggled between their "real work" profile and some boring anodyne "CBP-safe" profile?Locking/disabling the phone, I think, only creates suspicion as we've seen in a previous case not long ago. But if phones can have a cloud back-ups, shouldn't it be possible to have TWO different "back-ups" that can be chosen at will?
  • spiclk
    Does "search your phone" include any externally-hosted content that can be accessed by said phone?
  • someothherguyy
  • ocd
    American society should have done something about the excessive power these agents have had for a long time at the border and in the travel authority. The things they would ask, and their attitudes and behavior were almost like drug induced paranoia with confabulations.Neighboring the country in Canada, the US seemed like shorthand for USSR when it came to the border and travel. This sort of policy will make the US unpopular and inhospitable for conferences or any other important gatherings that it's taken for granted.
  • someonebaggy
    The constitution is officially toilet paper.
  • monster_truck
    I don't travel with any of my shit anymore, I take my old phone/laptop with nothing but music, separate debit/credit cards, tickets/itenerary, and whatever other little things. No contacts, no icloud, no saved passwords, etc. Been doing it for over a decade.TSA once gave me SSSS for 5 years after they tried making me answer a survey that asked me to prioritize things like "health", "safety", "privacy" as a ranked list and I refused to do that. Fuck em and anyone dumb enough to work for them. I was already used to showing up 4 hours early because they always make me take every single synth/sequencer/etc out so they can swipe it down to check for terrorism particlesI also get groped every single time because my dick shows up on the scanner. So goddamned worthless
  • chriscrisby
    The Government can search anyone or any thing that is attempting to enter the Country for any reason.If you’re just now getting upset about this then you need to check your political bias becise that’s the only thing that’s changed.
  • sokoloff
    > “In [Fiscal Year] 2025, out of the over 419 million travelers CBP processed at ports of entry, CBP only searched the electronic devices of 55,318 international travelers,” the agency wrote, or 0.0013%.By my math, that's a little over 0.013% (ten times the cited figure).
  • WaitWaitWha
    reading the article> The agent took the phone away and only returned after approximately 45 minutes, during which Kennedy believes that data on the phone was copied. He was then released with no charges.Does the owner, Mr. Kennedy has actual knowledge/proof if the phone was copied, or this is a guess? Might be missing from the article.
  • ulfbert_inc
  • numlock86
    > "land of the free"Amazing development from idea, vision and lyrics to the current status quo.
  • tdsanchez
    Carry a burner old phone and ship your actual. Be prepared to smash the phone or otherwise brutalize it if they demand to search it, then let them have at it.
  • rdm_blackhole
    I responded to comments on this thread or on other threads but just in case you think this is a US thing only, it is not.The UK border agents (technically counter-terrorism) can stop you at the border, force you into a room, ask for your passwords to all your devices and you don't have the right to refuse.You also don't have the right to have a lawyer be in a room with you and you are compelled to answer all their questions and finally they do not need to tell you why they stopped you.Then, if you are lucky they return your devices 7 days later after they have been through everything or they can keep them forever if they find something suspicious.This guy (who is a British citizen) went through it last year and talks about the whole procedure: https://youtu.be/991kRp8KUmo?si=-5S1uLE7K9KG_gNj
  • LWIRVoltage
    Copying from another comment I made on this:#1. The download and restore backup method would work for people in general- except it doesn't capture what people would need. Exmaple: I have some thermal cameras that rely on old 32 bit apps that do not run on anything android 12 onwards- If i wipe those old phones, and restore- the apps often wanted to reach out to a server for initial activation- they would fail upon reinstall and i'd be out of the apps that are required to control my cameras and related equipment,which is worth several thousand, and has no equivalent spec wise and form factor today in 2026. And it'd be all dead weight and rendered useless.( competitors today do not compete now- for example try finding a 640*480 30 hz or better form factor thermal camera that attaches to phones - they dont exist anymore)\The solution is full imaging- but there isnt a real way to fully image phones and restore backups today. There used to be it seems- but not really with the latest stuff at the time of this post.On another note:Veracrypt- The weakness of truecrypt and veracrypt, Their strongest counter, the hidden OS option only worked if you converted your computer to MBR, which means you can't have a hard drive too large. Making a UEFI hidden OS has not been done yet, but all computers are this now.And the Hidden Volume option- isn't 'as' useful, and of course, your OS might make a copy and put it somewhere, you have to be careful. As a example: Any time I open a file, using the software tool Everything to search and confirm this- you can easily see Windows makes copies and temp files and whatnot in randomly named locations- that's the sort of software and OS behavior that will screw people over.( The year of the Linux desktop isn't here yet..)Solution:We need fully image-backup capable Phones. I mean fully. Not just backing up some apps- as this refuses to backup apps you have that are no longer on app stores, or that Play Protect doesn't like, etc. We need to be able to fully image a device, a forensic image backup, for phones that people can use, then encrypt and upload so they are good if they lose a phone.Next- Plausible deniability is a way forward- but you need multiple profiles, that are cryptographically indistinguishable, along with the phone being hardened so GreyKey /Cellebrite won't be able to exploit a way in. This needs to be built this way from the ground up ideally, eventually.There has been research about making devices that treat all block space the same way so you can't tell if someone has 1, or 50 profiles or partitions, etc- and even stuff that overlaps. Often it needs to be fixed size partitions, but it is apparently NOT impossible to create. I am aware of Shufflecake attempting to make a solution for Linux, and yes, a Hidden OS option that is forensic- invisible.But nothing has come out yet - and especially, nothing in this vein for phones.It would be nice to see the day where, if you travel to a hostile country, you can tell them you have just one profile, and if they ask, you could theoretically mention a 2nd, and then show it- but you might have 3 more - and they'd all be immune to forensic inspection if the system is built right.(Yes, there's often issues you have to be careful of ,like setting this up so you dont destroy data when in other profiles, but that's not as important)This is how you solve this problem in the long run-make computing devices impossible to analyze, but standardized.
  • frunklooper
    China can search it remotely
  • mexicocitinluez
    I remember going down a rabbit hole of Youtube border security videos (like the TV show "Cops" but for customs and the border) and was shocked at how much power they have. It doesn't seem to be uniquely American either as the show takes place in Canada and Australia as well.They'll go through everything: phones, journals, mail. They'll straight up call people in someone's phone and question them if they think it's relevant.
  • tamimio
    I know the focus is on him getting searched and all, but I think what’s important is the auto-tagging or flagging of people based on something like a post made online or similar. This is far worse as it implicates mass surveillance, mass AI use to automate what should be done after due diligence, and how that obviously can and will he used politically as opposed to criminally.
  • pezezin
    Which government?
  • micromacrofoot
    lol no they can't, I forgot the password
  • farceSpherule
    [dead]