Zum Inhalt der Seite gehen
An ok overview of security considerations & mitigating controls to protect privacy and reduce risk of harm when crossing the US border.

The author misses some utterly crucial details however.

1) When your encrypted device is on, it is in an *unlocked* state. Only by powering off such a device is it in an encrypted state. Further, MicroSD cards are often unencrypted. Check before you fly, and power off before the border.

2) (next post)

https://www.theguardian.com/technology/2025/mar/26/phone-search-privacy-us-border-immigration

#privacy #infosec
#privacy #infosec
Julian Oliver
2) The article suggests backing up to the Google, MS, Apple etc cloud services before hitting the border. This is poor advice, especially for the at-risk. The process for being awarded a warrant to search these services is quite streamlined on US soil.

If you do not have the luxury of a self-hosted or community-run cloud, then it's saner to ZIP up crucial data and encrypt the archive. Then, upload that to your BigTech cloud of choice. 7zip, FossZIP and WinZip all use AES-256, strong encryption
Julian Oliver
3) Never say "I will not give you the password to this device", as that can be construed as obstructing an investigation and shift your legal outlook for the worse. Just request a lawyer and stay mute.

As a last resort, if held and with no legal counsel, you can lean on Plausible Deniability, but only if pressed. Say you don't remember setting a password, that you planned to reinstall the device, and that they can have it.

Do not fight them taking the device(s). Act like you don't care.
Julian Oliver
A good 'cloudless' fall back when crossing the border is to backup to an encrypted external SSD or even better a USB stick and stash it in your checked-in luggage. A stick can be hidden inside something else, overlooked if your baggage is searched. You can also encrypt a stick and put it in the post, to send it to your destination before you fly.

Another is to fly with a burner phone, faux social media, faux email account. Your daily driver laptop and phone are powered off in checked in luggage
Julian Oliver
I get it why not flying over oceans is sometimes not an option. Funeral, essential work thing, very sick relative.

But it's worth saying that the final and very best mitigating control for safety at the US border is just to not cross it at all. Don't go there.

The US should be considered hostile territory right now, especially for those vocal about human rights and environmental defense, not to mention those critical of the Trump administration.

Just one social media reckon can be enough.
Chu 朱
We have drastically cut back our flying for climate reasons... but my partner has work in Asia.

His travel agent offered him a flight to San Francisco. He shot back "no amount is savings is worth risking ICE arrest".

Found a slightly more expensive flight through Vancouver.

It is absolutely hostile territory.
Julian Oliver
As I understand it, based on the information I have at the current time (pls check yourself), US citizens can deny requests to unlock their device (s) and may still be let in, but their device(s) may be taken and they risk being detained. If your device is taken you should ask for a Custody Receipt. If you have documents on-device that are legally protected, inform CBP.

A foreign national that does not unlock their device can be denied entry. Unless a P.O.I their device will likely not be taken
Julian Oliver
As always, folk that *must* travel to the US need to run their own threat models & risk assessment.

If you are a US citizen with views or work at odds with current regime: rather than cross the border with encrypted laptop & phone, travel with a burner you can safely hand over unlocked, no device in carry-on or luggage containing sensitive or incriminating data.

Buy new devices in the US 2nd hand (ideally cash) picked up or shipped to a friendly address, download encrypted archive from cloud.
Julian Oliver
As to suggestions to no-phone or dumbphone when travelling to the US: either will highlight you, an outlier against the population. You don't want that.

The goal is to pass screening.

I mentioned the Android burner for the at-risk. Good, but needs 1month+ ahead of trip, & is your only device at the border. Setup a GMail (not Proton) & social accounts (not Mastodon). Paint an inane portrait, a daily habit, Mass subscribe to boring things. Squirrel memes. Selfies & cookies in the gallery etc
Lioh
or even better. Don't go to a country where you can be arrested for just being yourself.
Julian Oliver
In general agreement. For some however this is not possible or humane. US citizens returning to their only home. Family abroad visiting a very ill relative, etc.
Lioh
I know what you mean.
⇧