Privacy watchdogs challenge laptop seizures at US borders

Privacy advocates have sued the Obama administration over its practice of seizing laptops, cell phones, and other devices at US borders and copying their contents even when the owner isn't suspected of wrongdoing. In a complaint filed in US District Court in New York City on Tuesday, the American Civil Liberties Union and the …

[Real Ale is Best]

And the moral of the story:

Encrypt your data, upload it to $filestore on the Internet, and download it once you have crossed the border.

[Anonymous Coward]

They don't like that...

One of our execs went to the US with a laptop that only had windows, office and a VPN client installed. Also had a CD with a disc wipe utility on it.

They wanted to know why he was bring in a laptop with no documents on it, and why did he have a secure disc wipe utility, what was he hiding. They imaged the disc before they let him go (after 2 1/2 hours). Hope they had fun trying to find the secret hidden info.

[Anonymous Coward]

Well, the simple answer to that is....

....to tell them that he has removed all the information from his laptop because he knew that they were likely to seize it. I imagine that this will irritate the bunch of control freaks who inhabit this sort of job, but I'm certain that there is no law that requires you to bring your information with you.

These days this is just a sensible security tactic for any business.

[Tigra 07]

Will that really fool them?

I believe they will be smart enough to figure out someone's hid stuff if their computer is practically empty.

That could just result in a deeper search, internet history, HD, Hidden files etc

This is a country which can turn the internet off now if someone threatens to hack the government, so hiding your data will just draw attention to you and possibly lead to you being detained while they make sure you're not a terrorist.

[Anonymous Coward]

Yeah store it on the internet...

That just makes things easier for the NSA. ;-)

The truth is that if you are carrying sensitive information you do want to encrypt it and keep it out in the open.

If a custom's agent asks. Tell them the truth. Its confidential information hence encrypted.

Use a strong enough encryption and encryption scheme (like encrypting an encrypted file) and you will have ensured your privacy.

I can see both sides to the argument. We live in dangerous times.

[Chemist]

Re : Yeah store it on the internet

If it's well encrypted it doesn't matter where you store it

[Anonymous Coward]

@chemist

If you say so... ;-)

Hint: One thing bad about a password. You have to be able to remember it.

This means that you're limited on what you can use for a password.

So its always better to keep the 'personal' data handy and accessible.

[Intractable Potsherd]

"We live in dangerous times"

Well done - you have learned you propaganda well. Go to the top of the class.

[Anonymous Coward]

Delusions of Grandure

What you have is the issue of US Customs, and Law Enforcement in general, does not attract the best and brightest of society. It tends to attract people with "bully" tenancies, who if they are given a little authority, will use it just because "they can". Under the US Constitution, "fishing expeditions" by law Enforcement are not allowed. At a minimum, they should be required to demonstrate "probably cause" and better yet, have to go before a judge and present a "reasonable suspicion" argument.

[Jabberwock]

You're right...kinda

I agree about the meatheads in customs, however in regards to the US Constitution protecting those crossing the border, it gets more complicated than you made it out to be. There is a border search exemption to the fourth amendment which removes the requirement for a warrant. What the exemption does NOT do is completely remove the protection from unreasonable searches, and routine and non-routine do not seem to be direct equivalents to reasonable and unreasonable.

If the US did not have such a right leaning Supreme Court, I would say that we would eventually come to the position that computer files are like private correspondence and that a non-routine search would be unreasonable, as the possibility of finding contraband in a computer file is much less likely than finding contraband in a letter or package. Unfortunately our current Supreme Court is unlikely to split from Rehnquist, who issued an opinion stating that the entry into the country makes searches reasonable. Stephens dissented, of course.

http://supreme.justia.com/us/431/606/

On the other hand, he did not seem to disagree with the guidelines which prohibit the reading of private correspondence, but I'm certain that Scalia, Roberts, Alito, and Thomas will ignore that particular point.

[Anonymous Coward]

Why DID he have piccies of terrorist organization rallies on his laptop?

I'm curious too.....and hey, if .gov wants a copy of my laptop/cell phone drives they're welcome to 'em, nothing in there....

[JarekG]

Title, what title..

Cause he ca, cause he was viewing article that had those images, cause he wanted to document for his own personal library how cruel people are in general.....should I go on????

But hey, i'm sure it's in the good interest of it's citizens to prevent terrorism...

[Someone Else]

Short answer:

None of yer damn bid'niss!

Now sod off, azzole!

[Anonymous Coward]

Why, that's perfectly plausible

A man could be involved in a research project: jihad, terror, inter-religious relations - those are very popular research subject nowadays, not to mention them being a hot debate subject in any university campus.

Snap out of it! Taking pictures of high buildings doesn't make you a terrorist, any more than having a copy of your CD on your iPod makes you a thief or keeping a photo of your kid in your wallet makes you a pedo.

Paris, because i'd like to search her lap...top...

[Anonymous Coward]

@Why DID he have piccies of terrorist organization rallies on his laptop?

Hope you enjoy the view while you grovel on your knees.

[Anonymous Coward]

MYO-F-B!

We was a researcher into political activities and as such he has more interest than most? Or how about you mind your own f**king business?

Talking of twats jumping to conclusions. Out of interest, you don't work as the security guard in a well known store in Glasgow? I was in said store the other day and a smartly dressed, olive-skinned gentleman walked in and almost immediately he was followed by a rather repugnant rent-a-cop, right up until he left some 2-3 mins later. In the 15 mins I was there, no one else was followed in the same manner, but then everyone else was of a pasty/yellow skin, that's quite popular north of Hadrian's Wall.

[Anonymous Coward]

Yes...

, nothing in there....

Oh that's ok.

So if your a business exec with classified business material,

Or if you work for a foreign goverment

Or you work in child protection, and may legitimatly have images of child abuse on your pc.

Or your are doing research on the Isreali / Arab wars and hope to find a solution to the conflict

Or you've discovered the means to purpetual energy and are of to patent it in person.

Just because you are a nobody with an incredibly mundane life and job, doesn't mean everyone else is.

[DaemonSeed]

U can't haz my brainz nowai

Note to self, Never Ever Ever Never, bring any electronic device to USA ... Leave all such things at home, even alarmclocks, electric razors, camra's ... if when visiting USA , purchase on their side cheap stuff use it there then discard before returning home. They shall Never Ever Ever Never have any of my actual belongings. (no, not even my micro-snot boogers.)

[hplasm]

Or your cash-

Don't go.

I feel sorry for the US citizens- they have no choice.

[TBW]

Current admin's practice?

While I'm sure they're suing the current administration by default, I'm not sure I'd word it as "the Obama administration's practice" of seizing such things. It makes it sound like this is something new that the current admin created and implemented all on their own.

They're not the first, and are just continuing a trend that's been in place for quite some years now. Though I certainly would like to see it shot down regardless as I find it despicable. I just find the current wording of the article's opening statements a bit misleading.

[Anonymous Coward]

Linux FTW

If they should choose to peruse my hard drive; good luck. The entire drive is encrypted with secure file containers for any personal files... of course they can see anything on the Windows partition, but I wouldn't use it for anything important.

Now to take my laptop South of the border a few times...

[JaitcH]

You can't trust government!

Many countries are playing this game, with Britain adopting the most extreme position - Blair's password or prison option. Carrying a video also seems to keep border Plods satisfied.

It's best to use TrueCrypt with a minimal OS as the cover with a few innocuous notes and the good OS and data securely locked up.

Cell phones should have all data stored on n encrypted computer with all registers cleaned out along with the SIMM. Contact numbers are best stored on the SIMM, too. The cell should be powered down for at least 30 minutes before Customs as data lingers in memory.

Inserting a very small piece of paper over the battery terminals will often persuade them the battery is flat.

Hopefully this action will prevail - remember anyone within the borders of the U.S. of A. enjoys the protection of The Constitution, not just American citizens.

[Shades]

But...

"remember anyone within the borders of the U.S. of A. enjoys the protection of The Constitution, not just American citizens."

Until you actually successfully pass through border control you are not yet within the borders of the United States and hence do not enjoy the protection of the Constitution. This is how the PREVIOUS administration justified the searching, and retaining, of personal data when it was introduced.

[Blake St. Claire]

Where am I then?

Seems to me that border control has no jurisdiction outside the U.S. Either you're in or you're out.

Probably someone will claim that there is a ten or twenty foot area of no-mans-land at border crossings where the Constitution magically doesn't apply, but if that's the case, and Canada or Mexico want to claim it, we would not have a problem, because it wasn't ours in the first place.

Our Constitution just says "...[no] unreasonable searches and seizures..." It doesn't say "...except at border and at the international arrivals hall at the airport."

The U.S Constitution protects my rights as an American citizen, WRT the U.S. government, everywhere -- not just within the borders of the U.S.

[Mike Kamermans]

Anywhere within 100 miles of the border, the 4th amendment does NOT apply. To ANYONE.

Unknown to many, the US constitution's fourth amendment (and in fact several other parts of it) does not apply ANYWHERE WITHIN 100 MILES OF THE BORDER.

The ACLU calls it the "constitution free" zone, http://www.aclu.org/national-security_technology-and-liberty/are-you-living-constitution-free-zone, but that's not a 100% accurate term. However, what it does mean is that you cannot argue the 4th amendment to any official anywhere within 100 miles from the border. Even if you've entered the country and drove a good hour into it at maximum speed, a stop and search is still perfectly legal regardless of whether you're a drug trafficker, a tourist, or a US citizen.

[Anonymous Coward]

@Mike Kamermans

Mike is quite correct, and furthermore, many people don't realise what classes as a border. Within 100 miles of an international airport is a border for example.

The reason ACLU call it a constitution free zone is that other restrictions apply. A visitor or alien has to be in possession of all immigration documents at all times within a border area, and the police can stop them and demand they show documents at any time. This means that, in theory, every foreign worker in New York is supposed to carry a passport and all immigration documents with them at all time. Even on a run around central park. No-one is enforcing this rule in NYC, but there have been some cases elsewhere in the state.

Remind anyone of anything?

The spams stopped taking note of their own constitution a while back. Gitmo, waterboarding, etc. All signs of an empire on its wane.

[Anonymous Coward]

Try much older than that.

The policy of requiring documents within 100 miles of the border actually significantly predates the Bush or Obama administrations. As far back as the late '70's (Carter administration) I had to provide my identification each time I traveled by bus north and I'm definitely non-Hispanic.

[Mage]

We need to know

"devices of 6,671 travelers from October 2008 to June 2010"

And how many Terrorists did that net?

[mmiied]

RE:we need to know

0 (zero)

[Anonymous Coward]

Well!

Well as we all know there would be darn sight more IF they didn't do the searches! Them terrorists are a sneaky bunch so used to simply walking into countries with their plans carefully documented in easy to read PDF, XLS and DOC format files in carefully organised folder structures!

[Anonymous Coward]

nothing inaccurate about "current admin's practice"

This is the current administration's practice, and it's their policy. They reviewed the Bush-era policy and issued new rules in August 2009 limiting it somewhat. During that review they could have decided to stop pursuing the policy, but they did not.

[Momiji]

Encryption...

...won't really work when they detain you until you unlock your encrypted partitions.

Also, what TBW said. Don't feed the Tea Party trolls more than they already are.

[Anonymous Coward]

Truecrypt hidden partitions to the rescue..

...once again

[Anonymous Coward]

@Momiji

If you're a US citizen, it would be an illegal detention and a violation of your civil rights... (Although there are reasons why they could argue that it was a legal detention.)

Worst case is that they put you on the 'no fly' list which makes your life a bit harder.

[Matt Hawkins]

Give up your passwords ...

"won't really work when they detain you until you unlock your encrypted partitions."

Use Truecrypt.

Give them the password.

They can then look through the files at their leisure. Obviously they won't be seeing anything in the hidden partition.

The other option is to not bother going to countries with such stupid rules.

[Juiceman]

Copyright

I sure hope they don't copy any of my mp3's... The RIAA will sue the U.S. Government out of existence.

[PsYcHoTiC_MaDmAn]

rubberhose

for all those talking about encryption, doesn't work as they will want the key, and/or they will send it to people like the NSA to break it....

therefore use rubberhose, give them the fake key, real stuff is still encrypted, and they cant say you didn't give it.

[Anonymous Coward]

TrueCrypt

The previously mentioned TrueCrypt is a much more mature, user-friendly package and also has the fake password feature.

[Mark 65]

NSA, err no

They won't be bothering them with the effort involved in breaking encryption unless there's something juicy to be found i.e. you are a known terrorist or have links to etc. They certainly won't be bothering them with cracking the encryption on your truecrypt container containing grumble pics.

[Anonymous Coward]

@PsYcHoTiC_MaDmAn

Truecrypt does the same thing if you use the hidden partition option, plus it's compatible with Windows.

[Lee Thirteen]

are you sure?

My *mate* in Brazil has thwarted both Brazilian and US authorities with his TC-protected system with IncrediPassword.

TrueCrypt + Plausible Deniability = where it's at.

[Ian Michael Gumby]

@Lee

Your 'mate' as you put it was at the center of an investigation in to criminal activity. Unless the TSA is in fact investigating you... they won't go through the hassle or expense.

[Anonymous Coward]

So what you do is...

Encrypt some simple road-runner cartoon. Label it "overseas rally"./"Molly 10 years"

Beep Beep. Zoom.......

Wile E. Coyote attempts to strike again.

[Anonymous Coward]

Solution: Never fly to, or via, the USA

Works for me anyway.

The result of this policy is that I mostly fly via such bastions of civil liberties as Malaysia, Singapore, Hong Kong.

Hey at least they don't want to iris scan and fingerprint my kids.

[sT0rNG b4R3 duRiD]

I agree.

We would do well to watch our own governments to make sure they don't end up like that.

[Dr. Mouse]

The simple answer

is to not hold any data on your laptop. Keep it all in a remote file store of some description, and access it when needed. Ensure you don't store passwords/keys to it on the laptop itself.

Then if they want, they can copy everything from the laptop. There is no 'data' there, nothing personal or private, just the apps needed to access it.

[Anonymous Coward]

Posturing from both ends

Don't you think all this "I'd do this and that" is just IT nerd posturing to counter the TSA posturing?

First off anything encrypted on your computer is just going to grab their interest and probably result in a much bigger delay at the border than you would get if you just said "Sure go ahead take a look".

Frankly I don't care if they look through my contacts list, documents or even look at my email. I have a lot of very confidential work stuff on here but they are not going to understand the mathematical ramblings of a team of wireless Phd's or care in the least about the project schedules I have for our customers. It might get a cursory glance but it's not going to make me feel 'invaded'

The best approach is not to have the pictures of the last reunion of your terrorist cell or the instruction booklet for that thermo nuclear device you just bought off ebay hanging around on your computer when you are going through the border checks. Any muggins terrorist is going to know that and will have sent a paper copy in the post already.

Yes we all know they are doing this just because they can but that's the point they can so just make it easy and you will be on your way without delay and you can just think to yourselves that you have justified that persons job for the day and his/her family will not have to resort to benefits. Think of it as a public service

[Anonymous Coward]

@Posturing from both ends

Well of course that's right, no one cares about them looking through stuff you don't want kept private. That's precisely the reason the truecrypt plausible deniability system works so well, if they see an encrypted file, you give them access, they see some mildly private stuff and you're on your way. They don't even know there is a hidden partition with your bank account and credit card details in it, (I'm assuming even you wouldn't want some minimum wage border monkey rooting through that would you?)

It only becomes posturing if they know you're hiding something and you are taunting them with the fact they can't access it.

The whole point here is there is no reason to just bend over and give anyone who wants it access to your personal data just because they feel like it. If you don't care about your personal right to privacy fine, lots of other people do care very much however. (I also don't feel any obligation to justify some jumped up night watchmens job).

And as another commenter has pointed out, having nothing incriminating on your computer doesn't guarantee you won't be hassled anyway so screw 'em.

[Anonymous Coward]

Do you homework first.

"First off anything encrypted on your computer is just going to grab their interest and probably result in a much bigger delay..."

You really have no idea how Truecrypt plausible deniability works do you. Here's how the conversation goes.

Gimp: Can I look at your laptop contents

You: Sure

Gimp: I see an encrypted file [assuming he can even spot it of course - what does he search for?]

You: Yup, it's personnal stuff

Gimp: Can you unencrypt it so I can see the contents

You: Sure [enter duress password]

Gimp: Ah. Nice personal photos. OK on your way.

This is not posturing - in fact is it the oposite - you play along the whole way.

[Anonymous Coward]

and do your homework as well....

http://www.zdnetasia.com/schneier-research-team-cracks-truecrypt-62043884.htm

[Anonymous Coward]

China's looking better and better

It would be really nice to say "well just don't go to the US", if only the UK wasn't a considerable amount worse. At least the septics waited for the WTC/Pentagon to start turning the US into east Germany; the UK managed to pre-empt it by a couple of years with RIPA and a host of other ways to feel your collar. But they must have been delighted when the excuse came rolling along writ large.

I haven't/won't visit the US and be treated like a second class human being by being scanned and fingerprinted, but I've long lost any smug notion that the UK and Europe are better in the slightest. As we all plunge headlong towards what I think will be the worst few decades in recent history, it's worth pondering whether the so-called "democracy" we "enjoy" is of any actual use without transparency and accountability.

[Anonymous Coward]

Simple Solution

There is a simple solution to this. For the rest of the world, that is.

1: Make passing the US border a fire-able offense.

2: Refuse to do business with companies that send people or data through USA

3: Refuse to do business with companies that does business with the Federal US government.

4: Until such time that USA respects international laws (and that includes the international crimes court, and war crimes tribunal!), write "being a US Citizen outside of USA" in as an international felony.

5: Round up US citizens abroad in KZ-camps similar to gitmo.

6: revoke US diplomatic visas.

This would be the _ONLY_ way to make USA once again be a beacon to follow, not to shun.

[Montybank]

TSA your friends and mine...

Travelling into the US from the UK this summer I was grilled at LAX. It seems that as my US passport was new and unstamped (a renewal), and I'm a naturalised US citizen, I'm A#1choice as a terrorist. Another strike against me was that I was born in that terrorist hotbed, The Bahamas. (if they had been searching for drugs, now that's another story...)

As it was holiday and I would also be visiting my well wired brother, I left all computing devices at home in order to specifically avoid this sort of treatment. They didn't believe that I didn't have a laptop, and therefore searched my carryon, and then my luggage to find it. When they grudgingly let me go, I was told that it would have been easier if I had co-operated with the first officer... I couldn't get anyone to tell me what I was supposed to have done differently.

Funny thing is my brother is a detective in the US, and flies quite a bit for work but as far as he's concerned TSA really means "Thousands Standing Around".

[Anonymous Coward]

TSA

Tough Shit, Arsehole

[Craig 12]

As usual, non issue for the real bad guys

This is some blanket BS that will only inconvenience normal people, I'm sure we can all agree on that.

Until the US stops selling mobile phones and laptops within its borders, any criminal type can simply purchase after the inspection, perhaps even in the airport :)

Maybe if they twig this, going in to the US *without* a laptop will also look suspicious. The endgame is suspect everyone, guilty until proven innocent etc etc. El Reg needs a tin foil hat icon...

[John Munyard]

More monkey misses the point

I suspect the funny thing about this is that your average terrorist is (I would think) very unlikely to be stupid enough to carry storage devices through US Customs. They would be wary of being a terget for searches anyway, and (if I were them) would be accessing email/content from kit borrowed/purchased in the country once inside.

What we have is pure showboating. The only people inconvenienced are the general public. It would be interesting to know how many of the thousands of devices seized actually contained terrorist related content that led to a conviction? Probably not many, if any I suspect.

[Anonymous Coward]

Dissapointed...

I was disappointed by US customs when I travelled with a netbook earlier this year. It has truecrypt (full disk) with hidden truecrypt volumes as well. I wanted to see how far they would take the search, and whether they would even bother searching once they saw that the netbook happily reports 'Missing Operating System' when is starts up. For those of you using TrueCrypt - yes, that is my TrueCrypt password prompt.

[MarkieMark1]

what do we have to hide?

All that most of us have to hide could be a few business secrets; most of the time those would hide nicely in a few disguised truecrypted files; beyond that, even the goons really would rather not look at all the photographs of your auntie's birthday 2007

Saying that, goons are goons, I once needed a laptop sent to me in the states, far from ever turning up - it went 'missing' for a month+ before returning to sender - it seemed to have picked up motherboard burns around the integral modem; looks as though someone put 110v into the modem! :-D You have to laugh now although the cost of the replacement motherboard was less humorous at the time

that should be 'new motherboard' rather than 'new keyboard' :-)

[Anonymous Coward]

Theatrical Security Agency

it's all smoke and mirrors.

They're busy distracting Americans from the behaviour of their successive administrations which is what causes the problem in the first place and not actually stopping terrorists... if they were having huge successes busting rings of international terrorists (and/or the domestive variety a la Unabomber) don't you think there would be big press conferences about it?

In the US, UK, AU and other countries I've lived and worked in the focus is actually on removing/reducing civil liberties and pushing everyone towards the goal of nations of ill educated, uncomplaining consumers who don't travel, think or cause a fuss.

While I don't believe that the US Govt were behind 9-11 or any of the (hopefully) more far-fetched consipiracy theories I'm cynical enough to realise where this all ends.

For those of you who have not seen Idiocracy... watch it for a glimpse of the future :)

[Keris]

That big country south of Canada

... can do without my presence or money. I've been refusing to go there since 2001, when they started the extreme border nonsense. OK, I have a number of friends there, and there are places I'll now never visit, but the friends can come here (or we can meet in Canada or or Europe or somewhere else) and there are plenty of other places in the world to see where I feel safer (like in China).

Yes, the UK is as bad in many ways, but at least they don't search my laptop when I return from Europe, or fingerprint me, or otherwise treat me as a criminal just because I want to (re)enter the country.