Whitehat Hacker Moxie Marlinspike's Laptop, Cellphones Seized 484
Orome1 writes "The well-known whitehat hacker and security researcher who goes by the handle Moxie Marlinspike has recently experienced firsthand the electronic device search that travelers are sometimes submitted to by border agents when entering the country. He was returning from the Dominican Republic by plane, and when he landed at JFK airport, he was greeted by two US Customs officials and taken to a detention room where they kept him for almost five hours, took his laptop and two cell phones and asked for the passwords needed to access the encrypted material on them."
4th (Score:5, Insightful)
Re:4th (Score:5, Insightful)
Re:4th (Score:5, Insightful)
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
"I'm still not sure how this doesn't violate the Fourth Amendment."
You think the government or its workers still abide by that silly old piece of paper known as the constitution when they can get away with not abiding by it? That's funny.
"isn't that the same as having a secret in your mind?"
An unreadable but visible secret.
"Isn't that stealing from the passenger then?"
It would only be stealing if he was deprived of something.
Re:4th (Score:5, Insightful)
At least the RIAA and MPAA are not grabbing my penis, fondling my beasts or rubbing their hands all over children yet.
This airport theatre is OBSCENE, ethically and morally wrong on EVERY level.
Those who are able to justify it makes me think they are unhinged.
Re:4th (Score:4, Informative)
"This airport theatre is OBSCENE, ethically and morally wrong on EVERY level."
Vote with your wallet and don't fly. Deny the airlines money by not using their services. The purpose of security theater is mostly to restore faith in air travel and keep the airlines running.
We can afford to lose a few airliners as easily as we afford to lose thousands of terrestrial travellers in auto crashes, if we CHOOSE an equal level of indifference.
It's about psychological impact, not dead people. Life is cheap except when taken in exotic ways with lots of media coverage.
Re: (Score:3, Funny)
Vote with your wallet and don't fly. Deny the airlines money by not using their services.
It's about psychological impact, not dead people. Life is cheap except when taken in exotic ways with lots of media coverage.
Resistance is futile! better off with under garment strap-ons and butt plugs. The psychological damage should be the viewer's, not the viewee's.
Re:4th (Score:4, Insightful)
Perhaps you wern't prepared to grab another mans dude, and being in the forces, I can understand this, but I just want to fly to another city.
Probability of another "shoe" bomber or "underpsants" guy? Zero. 50 million enfordlements? priceless.
Friend, how long do you think it will be before they are doing this for buses and trains? Tracking your car and its movements?
The USA *was* a great country. You have but lost your way and maybe this sharp slap will remind its PEOPLE as to WHY the constitution was written.
Re:4th (Score:5, Informative)
Umm I think you missed the news announcement. They are already testing this at bus stations and train stations. So there is no need to wait, it is already here.
Here is the TSA patting people down at a bus station.
http://www.youtube.com/watch?v=_hT8hfrak9I [youtube.com]
Looks like the TSA are already at train terminals.
http://www.youtube.com/watch?v=ORdBoG8qv9w [youtube.com]
So it would seem that they are only left with us traveling by car. Although I hear that they have vans with the scanners in them and are going to use them at the borders to scan cars without people getting out them. Here is the company that is selling them.
http://www.as-e.com/ [as-e.com]
So it only a matter of time before the TSA is everywhere scanning everyone at the rate they are going.
Re:4th (Score:4, Insightful)
grabbing my penis, fondling my beasts
Wow! You must be an interesting shape! :-)
One Word: Shemale.
The constitution is pretty vague. (Score:5, Informative)
The constitution only protects against "unreasonable" search an seizures, with unreasonable being up to the interpretation of the courts. Border searches have long had a broader definition of reasonable (since the very first session of congress), and are not limited to safety and contraband. FindLaw has additional commentary [findlaw.com] on the issue.
Re:The constitution is pretty vague. (Score:5, Interesting)
Re: (Score:3, Interesting)
I believe it's a fundamental human right...
Question is if the US respects these ? or if they're just going to waterboard you...
Re: (Score:3, Interesting)
"They could see it wasn't a bomb from the xray and by me powering it up, "
Think it's annoying now, wait until some enterprising Jihadist figures out that the only barrier to making explosives that look like battery cells under x-ray inspection is bit of trial and error and some machine shop time to fab the tooling for fake cells. You don't need all the cells to power up a notebook for testing.
Re:The constitution is pretty vague. (Score:5, Informative)
No, the constitution protects against unreasonable searches and seizures, and then it specifically defines what that means: "no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."
The idea that the definition of unreasonable in this context isn't clear and present is a myth that is instantly dispelled if you simply read the 4th amendment. It's right there, plain as day.
Re:The constitution is pretty vague. (Score:4, Informative)
Border searches are not authorized by the constitution, they were an imposition of the 1st congress in 1789, an illegal end-run around article V, which dates from 1787. Consequently it doesn't matter one bit what the "standards" are for them. Until article V is used to make them an authorized power, they're an usurped, illegal procedure.
The constitution overrides and obsoletes common law; that's what it is there for, to reset the line and provide a new starting point because the previous situation was out of hand.
It provides a list of authorized powers, from which the federal government may make certain very limited types of laws.
As of 1791, it also provided a list of forbidden areas, into which the federal government may not go, and as it happens, that includes forbidding warrentless searches everywhere in the domain of the federal authority, because the restriction makes no kind of exception for any locale. So not only are warrentless searches illegal by virtue of not being an authorized power, the same people who made the law (quite sensibly) ruled them out just a few years later.
I'm not saying the feds shouldn't have such a border power based on any objection I might have with the idea of searching incoming foreigners; I'm saying it's unauthorized, and short of article V, there's no other way around that.
WRT common law, citing pre-existing English (or French, if you're from Louisiana) law is typical judicial dancing on the head of a pin, smelling its own farts. This isn't England (or France.) The whole point was to strike English law from our domain. To any extent that wasn't done, my take is that it's constitutionally invalid. I'm open to other arguments, but I've yet to encounter one that trumps the constitutional one. If the constitution wasn't put here to reboot the law, as it were, then what is it for? We already had English law for just about anything you can imagine, after all.
I should point out, though I would hope it is obvious, that I am well aware that the courts don't agree with what I am saying here; my response to that is that (a) that's my point, and (b) they are in violation of their oaths which say they will support the constitution, not old English common law, and (c) in point of fact, the constitution doesn't award them the power to disagree when something is outright forbidden, as warrentless searches and seizures are, and (d) the constitution doesn't award them the power to cobble up laws that stand outside the list of authorized powers, and (e) it isn't that I have any expectation that the government will do the right thing at this juncture, I am simply interested in the public learning what the right thing is.
Final point: The constitution is the authorizing document for a brand new government that in no way is "of England." Not for some specific derivative, or modification, of England's government. The constitution describes what this new government can do, and what it can't. Nowhere in the constitution does it say that the new government may incorporate English law, common or otherwise. Since that's not an enumerated or otherwise authorized power, in order to get such a power, article V must be pursued successfully, and as they did not do that, English common law is not valid American law. Ergo, the judiciary is breaking its oath, and much of the law is unauthorized.
Re:4th (Score:5, Funny)
The encrypted material might have contained something hazardous like a Uwe Boll movie. The risk of one of those being released to the public far outweighs any privacy or Constitutional concerns. Memories of House of the Dead and Bloodrayne still make me wake up in a cold sweat. Just imagine one that was considered unreleasable. Terrorist can kill thousands but a Uwe Boll movie can injure millions, or at least the hundreds that actually see them.
It probably is (Score:3, Informative)
Problem is it is going to have to get tested in courts, mostly likely the supreme court, and that takes time. Searches at the border themselves are completely legal. That has been established long ago. You have no expectation of privacy there, and the government has a right, and duty, to secure its borders. However the idea behind this was searching for contraband more or less. A regular search. The whole "copying your entire harddrive" or "taking your computer and not giving it back for months" is not some
Re:4th (Score:5, Insightful)
There's a 4th amendment exception around airports and borders.. they can search you for *no reason*. If you don't think that is fair, you're not the only one.
Work in law enforcement, national security, or for a politician? Want someone you want searched but can't get the probable cause for a warrant? No worries, wait for them to fly, search 'em at the border and find something suspicious.. now you can search the rest of their property.
Re:4th (Score:4, Insightful)
Here's a fun fact: the border extends to about 100 miles inland of the actual border to a country or the ocean. This means the Customs can search over 50% of the US population with near impunity.
Re: (Score:3, Insightful)
" essentially without limit, have been deemed reasonable."
Deemed reasonable by the constitution or just some judges who like to 'interpret' the constitution as they please?
Re:4th (Score:5, Insightful)
Go ahead: please tell us how you would enforce the 4th Amendment without "interpreting" the meaning of "unreasonable".
Re:4th (Score:5, Insightful)
"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."
I'm sorry, but I see no text there that says "this applies to all effects except those that the government decides it doesn't apply to."
Interpreting something doesn't involve changing its original meaning completely (especially if it was clear in the first place). It involves deciding to the best of your ability what it was originally supposed to mean as closely as possible. It's not like the fourth amendment was indecipherable. It clearly explained what it was supposed to mean, and a laptop can obviously be categorized under "effects."
Re:4th (Score:5, Informative)
No, the authors of the constitution didn't anticipate everything. But they anticipated quite a bit, and that includes unanticipated technology and social issues. In order to give the government the ability to deal with change, the constitution contains article V, which is the portion that outlines the procedure for amendment. Excepting amendment, they expected the constitution to be followed. Not "interpreted."
Our government, however, has fiddled its way into a situation where it does whatever the heck it wants. Make no law? Let's make some law!!! No state religion? Let's print Christian stuff on the money, carve it into buildings, sing it in the anthem, and best of all, use it in the courts for swearing... that'll teach 'em. Shall not infringe? Yay, let's infringe! Regulate among the states? Let's regulate IN the states! No ex post facto laws? Oh *heck* no, we GOTTA make those! Enumerated powers? Nah, let's just do anything we want, the heck with that! Warrants to search? Um... only in the interior of the country. And even then, maybe not. Probable cause? That's the same as "We like to grope", isn't it? Sure! No double jeopardy? Oh, that's easy, we'll just toss them back and forth between the criminal and civil court systems, they'll never figure that one out! Trial by jury? Same as "Lock in closet indefinitely, no lawyer, no phone call, innit?" Cruel and unusual punishment... yeah, what was that awesome torture we hung the Axis defendants for using at the war crimes trials? Oh yeah, water-boarding... let's do THAT! (and let's not forget we have rendition to play with, either.) Excessive bail shall not be imposed... heck with that, we'll ask whatever we want! Powers reserved to the states? Bwahahahaha. Oh, and the article III kicker... judicial power in constitutional cases: nah... let's just Make Stuff Up and skip that whole article V inconvenience.*
(*) It should be noted that the USG has steadfastly avoided violating the 3rd amendment, and should certainly be commended for its restraint in this matter.
Here in the US, we have government that has usurped powers far outside the explicitly authorized bounds. And that most certainly includes the judiciary.
In the end, it turns out that what the authors of the constitution wrote matters very little in our current legal system, because that document is treated by the government as barely relevant at this point in time, and even at that, only when it is convenient. Otherwise they ignore it, make things up, or simply plow ahead regardless.
3rd (Score:3, Insightful)
It should be noted that the USG has steadfastly avoided violating the 3rd amendment, and should certainly be commended for its restraint in this matter.
Except when it comes to installing spyware on people's computers - the cybernetic equivalent.
The point of "quartering troops" in people's homes was not just the seizure of the homeowners' resources to support the occupying army. It was also that the troops - living with the family, eating at their table, etc. - doubled as government spies scrutinizing all a
Re:4th (Score:5, Insightful)
Do you really expect the founding fathers to have anticipated computing devices that can encrypt data?
And furthermore, there's a reason that the Founders didn't try to enumerate specific communications technologies: they figured (apparently incorrectly, given your statements) that we would be able to logically extend our legal system to accommodate new technology, without requiring the citizenry to give up hard-won civil liberties as enshrined in the Constitution. It looks like some people are just unable to grasp that "personal papers and effects" might, I mean, just might, include a personal computer, and that that would indeed be in the spirit of the Constitution.
Do you really, in your heart of hearts, believe that the Founding Fathers, if they were alive today, would consider a hard drive full of a citizen's personal and confidential files to be in any way less deserving of the same legal protections afforded someone's wallet or their file cabinet? Do you really? Or are you one of these people who believes that the government should have the right to snoop into anyone's private business, for any reason, because they might have something to hide?
Spare me. This artificial dichotomy that is being presented to us by the government, that the "Internet" and "computing" are so intrinsically different from printed materials that the Constitution some how magically doesn't apply is disingenuous at best, treasonous at worst.
Re:4th (Score:5, Interesting)
The problem is not that computers are somehow different to papers.. if you were carrying papers across the border they'd be searched too. The problem is that, for some stupid reason, there's an exception to the 4th amendment around borders.. and that got extended into airports as being "effectively borders".. even when you're not flying international..
And what did people expect to happen? You exempt the government from honoring the 4th amendment in some "special" places that most people regularly visit.. you didn't expect them to apply common sense and decency did you?
Re: (Score:3, Insightful)
Do you really, in your heart of hearts, believe that the Founding Fathers, if they were alive today, would consider a hard drive full of a citizen's personal and confidential files to be in any way less deserving of the same legal protections afforded someone's wallet or their file cabinet?
Although I agree with your conclusion, I am troubled by this style of reasoning because (a) anybody can imagine the founding fathers have any kind of reaction they'd want the founders to have to conditions unimaginable in the founder's lifetime; (b) it assumes the founders were of one mind on what "liberty" means, which they manifestly were not; and (c) it deifies the founders, as if they had some kind of privileged access to the truth which we don't have.
The founders did an amazingly good job, but they scr
Re: (Score:3, Interesting)
That is a far more serious and permanent deprivation of liberty than the temporary loss of physical access to your laptop.
Uh, no. You can't just take someones property away. Not even temporarily. Again, the fourth amendment. They can't just make this stuff up (well, they can and they do, but it's not constitutional).
One might reasonably be deprived of one's laptop for a few minutes or even hours in service of some important public purpose
Important in this sense must mean whatever the government decides is important, because I certainly don't think this is important. I actually would like to follow the fourth amendment.
This is not reasonable at all.
It *is* in the era of electronic data.
Unless you were going around telling everyone about the data on your laptop, there is no reason they s
Re: (Score:3, Insightful)
Oh, please. The constitution is a set of principles, which laws are then written to implement. I'm no fan of the federal government (I think they have whole agencies that are not allowed under the federal constitution), but your expectation that every last detail - indeed, in anticipation of every last future development - be in the constituion is absurd. Do you really expect the founding fathers to have anticipated computing devices that can encrypt data? And to put that sort of thing in the constitution? Get real.
Encryption has been around since the early days of war and the founders certainly knew about it and (IMHO) explicitly guaranteed it as a right protected by the 2nd amendment. Think about it: for most of human history, encryption was *only* used as a strategic / tactical device. It's always been a means by which you organized the deployment of soldiers. If 2A is intended to enabled a "well regulated militia", it must cover encryption.
Re: (Score:3, Interesting)
Re:4th (Score:5, Interesting)
The courts, in point of fact, allow warrentless searches anywhere within 100 miles of the border, regardless of if you are, were, or ever planned to traverse the border. 190 million US citizens live within this region. Also, it is worth noting that the "4th amendment border exclusion" principle appears nowhere in the constitution. It's invented, unauthorized law. If they wanted it, the legitimate path to it was through article V. Consequently, it represents (yet another) usurped power.
Re:4th (Score:4, Interesting)
If the government had to build giant platforms 10 miles out to sea and require all people entering to stop there before coming into the country so their stuff could be inspected, they would. The courts give them some leeway as a nod to the fact that would be ridiculous for people trying to come in.
There is no rational justification for extending that "platform" to one hundred miles inland from the actual border.
As to "leeway", how about the recent case of a citizen of New Zealand who was flying direct to Canada. A mechanical emergency on the plane required it to land in Hawaii. All occupants were herded out into an open area in full sun, where they were required to stand for up to two hours while being interrogated, The citizen in question was, with all others, required to fill out a questionnaire including "Why do you want to enter the United States?", to which he responded, "I don't".
When he finally was allowed to have the questionnaire read, the TSA bitch gave him a hard time about his answer. He said, "I had no intention of entering the US -- the plane made a forced landing for reasons outside my control."
The bitch finally let him go.
Can anyone answer any of the following questions:
Why is not the "smartest nation on earth" not able to anticipate that a plane might have to make an emergency landing in the US?
Why were these people not simply sequestered outside of customs and allowed to reboard whatever plane was supplied for the rest of the trip?
Why were they treated worse than animals, with no shade or water? Even animals are protected by laws regarding reasonable maintenance. I know this because I have a relative who sends racing pigeons in crates to Hawaii, where they are released to race back to the mainland.
Why are passengers required to fill out all the bullshit when there is no intention to land in the US, just to perhaps fly OVER the tip of Maine.
What are the odds of a passenger on such a flight busting out of the plane and parachuting onto our glorious countryside?
Hilarious -- the captcha is "atrocity".
Re:4th (Score:5, Interesting)
I have to say that after my last trip (on business) to the USA, I would never consider it a suitable tourist destination for myself or my family.
From the moment I debarked the plane at LAX I very much felt that I (and everyone else) was being treated like a criminal.
How dare we (foreigners) enter the glorious US of A -- the most wonderful nation in all the world?
The gentleman who walked the very long queue of people waiting to clear immigration repeatedly threatened (not warned -- *threatened*) all those present with severe penalties if we didn't correctly fill out the forms he was handing out.
The official who inspected my passport didn't welcome me to the USA and invite me to enjoy my stay -- the treated me (and everyone else) with massive suspicion and contempt -- making it very clear that *they* had all the power and that I was a someone who ought to be eternally grateful for being allowed to enter the country.
Is that really the way to treat visitors?
And as for the latest usurping of citizens rights in respect to searches -- well I feel very sorry for the USA.
It is (although perhaps somewhat less-so these days) truly a great nation, built on principles of integrity and freedom. Unfortunately (as they say) "Power Corrupts" and it would appear that those in power have seized the opportunity to use terrorism as justification for unreasonably extending the degree of power they now exert over the people who elected them to *serve*.
Every day that the sacred provisions and protections of The Constitution are ignored by the US Government is another day on which the Islamic fundamentalists can claim another victory.
Instead of fighting on their feet, the citizens of the USA are now living on their knees -- having compromised the very principles (The Constitution) that made their nation so great.
Of course it *is* a democracy so perhaps those of you who are US citizens might want to think about exercising those democratic rights (before they too are taken from you in the name of "the war against terror" and installing a government who appreciates that the principles of The Constitution are still worth fighting for and that no bunch of Islamic fundamentalists should be allowed to usurp them by way of a campaign of terror.
Perhaps it's time for a referendum to allow the US people to decide whether the constitution should be abolished because right now, it appears that such an abolition is happening by stealth -- and by the time the people wake up to that fact, it may well be too late. The very rights this document bestows on citizens will be lost and thus even the power to protect those rights will have gone forever.
Just my 0010 cent's worth.
Re: (Score:3, Funny)
Re: (Score:3, Informative)
This has been litigated to death, and searches at the border, essentially without limit, have been deemed reasonable. Indeed, for a little bit inside the border, the same applies.
Here, in the USA, "a little bit" means 100 miles (160.9 kilometers) inside the border... 2 out of 3 Americans live within 100 miles of the border; No, it does not matter if you have crossed the border or not many of your constitutional rights are null and void in this zone [privacydigest.com].
Re: (Score:3, Interesting)
A *LITTLE* bit inside the border? Think again.
I believe that it's anywhere within 200 miles of either the border or of an airport at which international flights land. (Or, of course, a port at which international shipping docks.)
That covers most of the population.
Re:4th (Score:5, Insightful)
Link to longer article at CNET (Score:5, Informative)
Link to longer article at CNET [cnet.com]
Finishing the story (Score:5, Informative)
took his laptop and two cell phones and asked for the passwords needed to access the encrypted material on them.
Really, why try to sensationalize a story by omitting its outcome?
The fact that something as diriculous as "incoming data storage devices searches" even
exist should be enough of a story by itself, and that has been known for quite a while.
Ends justifying means? (Score:5, Interesting)
So...
Whatever happened to him in the mean time is OK so long as it reaches a satisfactory conclusion?
Most^H^H^H^H Some Slashdotters are smart enough to understand that the ends never justify the means, that this person was picked on, detained for 5 hours and subjected to an invasive search was _not_ all well and good because he got his laptop back.
In the end, I'd put good money on this person being picked up because he was coming in from the Dom Rep rather then because he was Moxie Marlinspike. The TSA likes to pick on single males coming in from potential sex tourism destinations, perhaps because it's the low hanging fruit. Bust a few guys coming back from the Philippines with some home made porn (a pic of a naked Pinay is not hard to get) and make it look like you're doing a great job, after all who would defend these dirty sex pests (they are probably all pedo's anyway). Incompetence rather then malice, but the end result is the same.
Re: (Score:3, Funny)
Time for him to invoke the china visit policy... (Score:3, Interesting)
I worked through this policy myself as an intellectual exercise [blogspot.com] (A protocol for China. Or Defcon. Take your pick).
Basically, take a laptop with an easy to swap hard drive. Swap in a new drive, with a clean image, and no access credentials except to a temporary dropbox account for emergency mail and/or working set.
Now if you are intercepted, there is no data TO capture, and you can remove all but hardware/bios trojans by a wipe and reinstall.
As a bonus, you can just take out the drive, hand it to customs, and let them have fun with it.
Re: (Score:3, Informative)
Basically, take a laptop with an easy to swap hard drive. Swap in a new drive, with a clean image, and no access credentials except to a temporary dropbox account for emergency mail and/or working set.
Now if you are intercepted, there is no data TO capture, and you can remove all but hardware/bios trojans by a wipe and reinstall.
As a bonus, you can just take out the drive, hand it to customs, and let them have fun with it.
International corporations are already doing something quite similar to this. You carry an empty laptop with you - and download an encrypted "project package" at your destination to install any special software, and any data you need. You encrypt and upload your product data (if you need to bring it back at all) and run a program that wipes the laptop before return.
But of course spies, criminals and terrorists would never think of doing this.
If you are that paranoid (Score:3, Insightful)
Then get rid of your computer. Seriously, because something like that you aren't talking half-assed law enforcement agency (which is what CBP is) you are talking national intelligence agency that really, really, wants your shit. Well you think that the only time they could pull something like that is at an obvious stop? Not hardly. They could do it before you ever get your hardware. So you order a new motherboard, they intercept the motherboard in transit, replace it with one they've modified, and on it goe
Not really (Score:4, Informative)
Again I think it is geeks puffing their own egos. Please remember that there's a vast, VAST gulf between law enforcement wanting to harass some guy, and a national intelligence agency being willing to spend a lot of money to try and snoop on them in an extremely covert manner. Remember that for the NSA to get involved, they have to be willing to break the law. Law says NSA is foreign only in their intelligence gathering. They can monitor communications to and from foreign locations, or systems that are on foreign soil but that's it. No monitoring in the US. I'm not saying they obey that in all cases, but that is the law meaning that if they got evidence its usefulness in a criminal trial would be nil.
So for them to even be willing to do that, there has to be a good reason. Then you are talking about some serious money spent to develop this custom monitoring BIOS that is both undetectable, unflashable, and ready to deploy on the specific device(s) this guy has. Then after all that, the totally ruin the secrecy by a big fluff up at the border.
Really? Sorry, but pushes the bounds of credibility way too far for me.
Remember that in terms of covert surveillance the US law enforcement agencies can do that very well, they just need a warrant. They could then tap his communications, place cameras in his house, monitor with tempest, whatever they get a warrant for, and do it all covertly. Also any evidence obtained in that way is 100% legal, unlike evidence the NSA got.
So why the border thing? Because they've got shit. They aren't expending any massive resources because there's no evidence of anything. The NSA isn't going to spend millions to try and monitor some guy illegally for no reason. However no warrant or anything is needed at the border so they harass him. Doesn't cost anything (the agents are already there) and so on. Also didn't accomplish anything but there you go.
Sorry but I just can't support this massive ego complex so many geeks have of thinking they are so important that the government will go to extremely difficult, nefarious, lengths just to try and monitor them, all while doing it in an extremely incompetent fashion. No, they won't. You are not that important, nor that sneaky. If there's a real problem they'll get a warrant to monitor and/or search for the evidence needed.
Re: (Score:3, Interesting)
Domestic only and foreign only agencies routinely track people for the other agencies.
Sorry but I just can't support this massive ego complex so many geeks have of thinking they are so important that the government will go to extremely difficult, nefarious, lengths just to try and monitor them, all while doing it in an extremely incompetent fashion. No, they won't. You are not that important, nor that sneaky. If there's a real problem they'l
Great, now it's trash. (Score:5, Insightful)
I would never trust my hardware again once I had handed it over to some customs (or other government agent) goons, and it left my sight. I would rather just remove the hard drive and hand it alone over to them, at least then I wouldn't have to trash the whole thing.
There's really no way to be 100% sure you successfully "re-flashed" the BIOS, or cleaned all hardware as some posters have said they would do. Not to mention: There could be additional hardware installed, 5 hours is a long time...
You could tear your machine apart and inspect it all you want, but it's well known once the enemy has unfettered physical access to a device, all bets are off.
Re:Great, now it's trash. (Score:4, Insightful)
Paranoid much? Shit, you could say that about new hardware as well. How do you know the manufacturers didn't put some virus/trojan, inadvertently or maliciously, on the devices you bought (especially now that most of those devices are made in China)?
Re:Great, now it's trash. (Score:4, Informative)
For instance the low paid TSA guys could be paid kickbacks to put keyloggers on there so that criminals can get credit card numbers. The lack of accountability would mean that it would be a very long time before somebody in that position would be caught even if there was a lot of evidence.
Personally I think we should get rid of that entire knee-jerk reaction organisation and replace their security guard style workforce with professional law enforcement with a clear chain of command and true accountability as was recommended in the first place. We wouldn't need anywhere near as many people and it would not cost as much. The only downside is it takes time to train such a group. We've got time, we've already had seven years of the sort of security staff you have to prevent shoplifting.
Re: (Score:3, Insightful)
Logging things done by a random buyer isn't the same as logging things by the guy we'd really like to know more about.
Re:Great, now it's trash. (Score:5, Informative)
Right, and if you read the CNET article he mentions that he's already disposed of all the checked hardware.
He also mentioned that the extra cost of hardware + embarrassment of missing meetings due to being detained and missing flights means his business is losing contracts and money, and he's thinking of refusing international clients. Maybe that's the government's goal.
Re: (Score:3, Insightful)
>> embarrassment of missing meetings due to being detained and missing flights
As disgusting as this whole episode is, the detention probably works for him, rather than against him. I didn't know this guy's name until a few days ago. Additionally, how many people do you know who are such security studballs that the whole US Government is out to intercept them at every turn?
Re: (Score:3, Insightful)
With the price of hardware these days it's hardly worth even getting it back. Once it's compromised; it's compromised.
I agree, once it's been in the hands of an adversary you just can't trust it any more. I would purchase a new laptop over the counter reload the encryption and restore from secure backup.
I had to do this recently after having a system stolen. Fortunately everything was switched off and demounted at the time but it has made me think about the possibility of running remote wipe software so tha
Travel Tip (Score:5, Interesting)
I travel to the US a lot for business. What I do is Fedex my "real" hdd to the hotel I'm planning on staying at, usually 1 day before travel to the US is enough for it to be there waiting for me when I arrive at check-in (obviously its an encrypted disk).
I travel with my laptop, with a small capacity hdd that has a clean install, some common oss apps installed, some bogus documents downloaded from scribed, some fake e-mail accounts with credentials saved in firefox and some typical surfing history. The aim is to make them feel like they've found the stuff they're looking for and that there isn't anything worth pursuing - rather than trying to be a smart-ass that makes them even more intent on performing those unwanted rectal examinations. I've had my laptop taken twice in the last 3 years, and on both occasions after providing access details, I was given the laptop back within 5-10mins, other people i know that tried to screw over the TSA/customs by not providing all the access details they wanted, ended up never seeing their machines again.
Though now with the new scanners at play in the airports, I'm trying to reduce my travel to the US to a minimum. If I have to travel, I charge a premium for the various inconveniences endured, most clients are sympathetic and pay without much fuss.
Re: (Score:3)
I What I do is Fedex my "real" hdd to the hotel I'm planning on staying at, usually 1 day before travel to the US is enough for it to be there waiting for me when I arrive at check-in (obviously its an encrypted disk).
Nice tip, but given the latest Al Qaeda shenanigans in Yemen with printer cartridges, shipping hard disk drives will probably be forbidden real soon.
I have traveled to the US on business a lot before 9/11 and a few times after 9/11. The difference in "security" is frightening . . . I'd call it "siege mentality." When the security folks look at my laptop, and I show them my company ID badge, that gets me passed through, no questions asked. But I have to wonder, what do you do if you work for Airbus, and
What's so important to warrant harrassing millions (Score:5, Insightful)
Even if a 9/11 scale event happened every single year, it would take more than four years to match a single year of alcohol-related deaths in the U.S.
We already know the solution to this. (Score:3, Interesting)
When traveling out-of-country, do not:
Bring your best laptop with you. Bring a cheapie that you don't mind losing. This way you don't have any real qualms about abandoning it when these ass-wipes pull this.
Keep anything important on the machine, encrypted or otherwise. Have an internet dead-drop you can push things to before crossing borders.
Leave anything important on the machine. Use a decent file shredder to eliminate it.
Re: (Score:3, Informative)
Re:First Post (Score:4, Insightful)
In short, federal policing powers given to the creme de la crap.
Re:First Post (Score:5, Insightful)
Re:First Post (Score:5, Insightful)
Data has nothing to do with customs. They are overstepping their jurisdiction just to bully people.
Re:First Post (Score:5, Insightful)
Other than their recently uncovered fetish for porn the intention of customs is good.
The idea of customs looking for data in the 21st century is laughable, have they not heard of the internet? That's where I import my data from.
Re:First Post (Score:5, Insightful)
Re:First Post (Score:4, Interesting)
It is _trivial_ to transmit data undetected into the US (nice to meet you, internet. how long have you been there?); what justification is there for searching laptops in the first place?
But you have to transmit the data to something. One of the things they look for when searching a laptop are clues as to which server systems you've been logging into. If they see by your browser history, for example, that you regularly visit hotmail.com, you'll probably be asked to log into your e-mail account so they can look for things there. If they don't find too many documents on your computer, they'll ask where you store them and have you log in there, as well. So, while the laptop might not contain the illegal data, it might contain clues as to where the Customs officers may find them.
Re: (Score:3, Insightful)
But it's not and until you convince the government to change the laws, those drugs and other things are checked for by customs.
Re:First Post (Score:5, Interesting)
Re:First Post (Score:5, Funny)
Next time, take a broken hard drive with you. That will give them a challenge. :-)
Re: (Score:3, Funny)
"Next time, take a broken hard drive with you. That will give them a challenge. :-)"
They'll probably just think it's one they've already processed.
Re: (Score:3, Funny)
or better dd if=/dev/urandom of=/dev/sdb bs=512
try decrypting THAT
Re:First Post (Score:4, Insightful)
Oh, this is easy! We'll just beat you with this rubber hose until you give up the key.
The beatings shall continue until the key is revealed!
Re: (Score:3, Funny)
or better dd if=/dev/urandom of=/dev/sdb bs=512
try decrypting THAT
YOU FUCKER! THAT COMMAND OVERWROTE MY WINDOWS PARTITION!
Re: (Score:3, Funny)
So why are you complaining? ;)
Re:First Post (Score:5, Funny)
Re:First Post (Score:4, Interesting)
When they figure out the truth, they could pretend to take you way more seriously than you ever want. And you would have given them the paperwork to cover their asses for it.
Perhaps you can do what you propose, then the rest of us can discuss the resulting story on Slashdot.
Re:First Post (Score:4, Funny)
Re:First Post (Score:5, Insightful)
So, Customs tried to erase all of your data on that drive? (If the drive was in a file system that they didn't recognize, like EXT3 or such, then writing files would destroy data)
Actually, why would customs mount the drive in a way that it could be modified at all? It seems like if they can modify it, anything they found would be tainted.
Re:First Post (Score:5, Funny)
This gives me the idea of building a slightly custom drive. It's not hard to do, really; remove the platters and there's plenty of space inside, then just put a cable to the outside controller board, concealed under it. The first idea that comes to mind is a drive that happily accepts all write and erase commands, yet presents a read-only filesystem.. say, with a troll image.. or better yet a *different* filesystem each time it's powered. Have fun imaging that. If you want writable storage, it could do a straight log of what the intrusive party did to the drive. The technology is near identical to current hybrid hard drives.
Re:First Post (Score:4, Interesting)
Did you SAVE that hard drive? (Score:3, Interesting)
I brought a just an internal sata hard drive to Canada from the US, while in Canada I wiped it clean. On the way back into the US they stopped me for a few hours.. When I got home there were large files all over the drive..
Sounds like one of three things:
1) They installed some spyware on it.
2) Their machine was virus-infested and infested your drive.
3) Your "wipe" was a remove rather than a reformat-with-surface-analysis and they ran an undelete utility. (Were those files your prev
Re:First Post (Score:5, Funny)
***They are all under the umbrella of the Department of Homeland Security whose core mission is to annoy, harass, and humiliate law-abiding citizens while letting the crooks slip through the cracks. ***
Very dubious. The DHS clownshow shows little sign of being competent enough to identify crooks well enough to let them through. Sleep well tonight, terrorists have exactly the same chance of being harassed by the DHS as anyone else.
Re: (Score:3, Funny)
Hey, at least get your terminology right, those guys didn't spend all that time at Gooning classes to be called 'thugs'.
Re: (Score:3, Interesting)
I would suggest entering (or exiting the US), have nothing on your HD/SSD but an OS with a few games/media player and a phone that empty and can be used once for a short time. In that case, why carry a computer and phone at all?
To complete the ritual. No one hides daggers in sleeves any more, but we still shake hands as a greeting.
Re: (Score:3, Informative)
uhh, customs and TSA have nothing in common.
Other than they are part of the same organizational chart [dhs.gov].
Re: (Score:3, Informative)
Once again, Customs is a legitimate and competent part of the government. The TSA is neither. Yes, they both fall under DHS. However, the Army Corp of Engineers and the NSA both fall under the DOD but are very different. Further, the TSA and Customs are regulated by different parts of the CFR. 19 CFR for Customs and 49 CFR for TSA. As in, you're wrong.
Re:First Post (Score:4, Funny)
"Customs is a legitimate and competent part of the government."
A part of the government that is both legitimate and competent? I never knew such a thing existed!
Re: (Score:3, Insightful)
> legitimate and competent
Really? So harassing someone and stealing their kit in the airport is "legitimate and competent"?
If someone *really* wanted to smuggle "illegal" data of some kind into the country, they wouldn't be daft enough to travel with it on their laptop. They'd encrypt it and email it to themselves; or upload it to a cloud storage service, or have a file server of their own to FTP it into; or dump it into some random usenet group; or any of probably a dozen other ways to move data witho
Re: (Score:3, Interesting)
Call me paranoid, but either U.S. Customs/DHS is totally stupid, or smuggling data into the country physically is the only way to get it in without being noticed nowadays. Has anyone looked into the possibility that Echelon and it's progeny might be active after all? Maybe the NSA can, to a high degree of confidence, wade though all online data traveling across the U.S. backbones. If they can't, and it's really that easy to get data into the U.S. via the 'Net, then the searches of the laptops are either A)
Re:First Post (Score:4, Funny)
That's not fair. From his Wikipedia [wikipedia.org] page he seems to be obsessed with finding ways to man in the middle SSL connections so he can present them at Black Hat conferences and allow people to commercialise the for as long as possible before they are fixed.
Where would we be as a society if that it were possible for people to make secure SSL connections to their banks for example? That would be a nightmarish world where it would be impossible to redistribute income from the first world bourgeoisie to more worthy informal entrepreneurs in impoverished countries like China, Eastern Europe or Nigeria.
I think he's doing socially very useful work. I'd recommend a prize for him, except he's probably not short of cash.
Re:First Post (Score:5, Insightful)
Without people looking for vulnerabilities in SSL and publishing the results there would be other people looking for vulnerabilities in SSL and not publishing, just using them to steal.
Security crackers that publish their results are essential to making sure we are really secure, not that we just think we are.
Re: (Score:3, Informative)
I don't really agree on the difference.
If there's a tool to exploit the problem then companies using SSL/TLS/whatever can see a clear and present danger.
If someone publishes a vulnerability it's easy to write it off as theoretical and we're back to the situation where black-hats can exploit things.
Re:First Post (Score:5, Insightful)
Yes, because certain criminals use the Dominican Republic to trade drugs, it's completely reasonable to assume that this person was involved in such activities. After all, nobody would go there to experience the culture, the cuisine, or the wide, sandy, sun-drenched beaches.
However, let's not forget that this guy is an American. There's more drug trading and murder going on in the US than in the Dominican. Obviously that makes him a gun-toting, murdering, drug lord, like all other Americans. I've seen Breaking Bad. The world would no doubt be a safer place if we didn't let Americans get out of the US.
Re: (Score:3, Insightful)
"After all, nobody would go there to experience the culture, the cuisine, or the wide, sandy, sun-drenched beaches."
Doing all that doesn't exclude playing drug mule.
You don't need a password to extract drugs from a hard drive.
Re:First Post (Score:5, Informative)
As for the second, please explain how in the fuck you get labeled a "white hat" for showing up at black hat conferences and showing everyone how to MITM SSL?
Black hats don't hold conferences (in meatspace). There's just a conference called Black Hat which, by the nature of information from the conference being made public, is actually a white hat conference. It actually started out as something closer to a true black hat conference but of course that didn't last long.
Black hats have their conferences in various chat rooms and forums. When they meet, you don't know about it.
Re: (Score:3, Interesting)
What makes you think that something presented at Blackhat isn't after 90 days notice to the developer? That's often the case - the threat of revelation after some fixed time provides some minor incentive to care about the vulnerability.
But even if not, it merely starts a race between the app developer and the exploit developer. In the case of some popular open-source app, the app developers would win the race (because they care, and know the code better). Not the best approach, but far nicer than selling
Re: (Score:3, Funny)
Re:Hidden volumes? (Score:4, Informative)
He could put the contents of the hard drive on a webserver, wipe the hard drive clean, then download the data once in the country.
Re: (Score:3, Informative)
TrueCrypt [truecrypt.org] because it works [slashdot.org].
FTK, PRTK?
Pffft, The FBI knows about those, and still didn't crack the TrueCrypt volume.
Re:Quick question (Score:5, Insightful)