Forgot your password?
typodupeerror
Privacy Security United States IT

Whitehat Hacker Moxie Marlinspike's Laptop, Cellphones Seized 484

Posted by timothy
from the why-do-you-hate-america dept.
Orome1 writes "The well-known whitehat hacker and security researcher who goes by the handle Moxie Marlinspike has recently experienced firsthand the electronic device search that travelers are sometimes submitted to by border agents when entering the country. He was returning from the Dominican Republic by plane, and when he landed at JFK airport, he was greeted by two US Customs officials and taken to a detention room where they kept him for almost five hours, took his laptop and two cell phones and asked for the passwords needed to access the encrypted material on them."
This discussion has been archived. No new comments can be posted.

Whitehat Hacker Moxie Marlinspike's Laptop, Cellphones Seized

Comments Filter:
  • 4th (Score:5, Insightful)

    by drumcat (1659893) on Saturday November 20, 2010 @01:15AM (#34289254)
    I'm still not sure how this doesn't violate the Fourth Amendment. Customs has the right to view your belongings for *safety* reasons, and to ensure that the items you are carrying are not contraband. Does code constitute contraband now? Can you be arrested for having code on your machine? I'm not talking about copyrighted, installed programs.... if something is encrypted, isn't that the same as having a secret in your mind? You know they dumped his drive, but the main question is whether they're allowed to. Isn't that stealing from the passenger then?
    • Re:4th (Score:5, Insightful)

      by Barrinmw (1791848) on Saturday November 20, 2010 @01:18AM (#34289268)
      What you want to do is to have something you copyrighted on your laptop, so if they copy your hard drive you can sue them for copyright infringement.
    • Re: (Score:3, Insightful)

      "I'm still not sure how this doesn't violate the Fourth Amendment."

      You think the government or its workers still abide by that silly old piece of paper known as the constitution when they can get away with not abiding by it? That's funny.

      "isn't that the same as having a secret in your mind?"

      An unreadable but visible secret.

      "Isn't that stealing from the passenger then?"

      It would only be stealing if he was deprived of something.

    • by pavon (30274) on Saturday November 20, 2010 @01:32AM (#34289340)

      The constitution only protects against "unreasonable" search an seizures, with unreasonable being up to the interpretation of the courts. Border searches have long had a broader definition of reasonable (since the very first session of congress), and are not limited to safety and contraband. FindLaw has additional commentary [findlaw.com] on the issue.

      • by afidel (530433) on Saturday November 20, 2010 @01:56AM (#34289448)
        I'm still not giving up my passwords on fifth amendment grounds even if I have nothing to hide. In fact I've told a TSA goon exactly that when they asked me to login to my laptop at a screening checkpoint. They could see it wasn't a bomb from the xray and by me powering it up, the only thing that logging in could have possibly done is get me into trouble for the contents of my machine.
        • Re: (Score:3, Interesting)

          by jopsen (885607)
          How about using the right to shout up and not to incriminate yourself... ?
          I believe it's a fundamental human right...

          Question is if the US respects these ? or if they're just going to waterboard you... :)
        • Re: (Score:3, Interesting)

          by couchslug (175151)

          "They could see it wasn't a bomb from the xray and by me powering it up, "

          Think it's annoying now, wait until some enterprising Jihadist figures out that the only barrier to making explosives that look like battery cells under x-ray inspection is bit of trial and error and some machine shop time to fab the tooling for fake cells. You don't need all the cells to power up a notebook for testing.

      • by fyngyrz (762201) on Saturday November 20, 2010 @02:25AM (#34289558) Homepage Journal

        The constitution only protects against "unreasonable" search an seizures, with unreasonable being up to the interpretation of the courts.

        No, the constitution protects against unreasonable searches and seizures, and then it specifically defines what that means: "no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

        The idea that the definition of unreasonable in this context isn't clear and present is a myth that is instantly dispelled if you simply read the 4th amendment. It's right there, plain as day.

    • Re:4th (Score:5, Funny)

      by Anonymous Coward on Saturday November 20, 2010 @02:27AM (#34289568)

      The encrypted material might have contained something hazardous like a Uwe Boll movie. The risk of one of those being released to the public far outweighs any privacy or Constitutional concerns. Memories of House of the Dead and Bloodrayne still make me wake up in a cold sweat. Just imagine one that was considered unreleasable. Terrorist can kill thousands but a Uwe Boll movie can injure millions, or at least the hundreds that actually see them.

    • It probably is (Score:3, Informative)

      by Sycraft-fu (314770)

      Problem is it is going to have to get tested in courts, mostly likely the supreme court, and that takes time. Searches at the border themselves are completely legal. That has been established long ago. You have no expectation of privacy there, and the government has a right, and duty, to secure its borders. However the idea behind this was searching for contraband more or less. A regular search. The whole "copying your entire harddrive" or "taking your computer and not giving it back for months" is not some

    • Re:4th (Score:5, Insightful)

      by QuantumG (50515) * <qg@biodome.org> on Saturday November 20, 2010 @03:38AM (#34289760) Homepage Journal

      There's a 4th amendment exception around airports and borders.. they can search you for *no reason*. If you don't think that is fair, you're not the only one.

      Work in law enforcement, national security, or for a politician? Want someone you want searched but can't get the probable cause for a warrant? No worries, wait for them to fly, search 'em at the border and find something suspicious.. now you can search the rest of their property.

  • by Anonymous Coward on Saturday November 20, 2010 @01:16AM (#34289260)
  • Finishing the story (Score:5, Informative)

    by the_other_chewey (1119125) on Saturday November 20, 2010 @01:27AM (#34289304)

    took his laptop and two cell phones and asked for the passwords needed to access the encrypted material on them.

    ...didn't get them, gave him back his hardware and let him go.

    Really, why try to sensationalize a story by omitting its outcome?

    The fact that something as diriculous as "incoming data storage devices searches" even
    exist should be enough of a story by itself, and that has been known for quite a while.

    • by mjwx (966435) on Saturday November 20, 2010 @05:14AM (#34290066)

      ...didn't get them, gave him back his hardware and let him go.

      Really, why try to sensationalize a story by omitting its outcome?

      So...

      Whatever happened to him in the mean time is OK so long as it reaches a satisfactory conclusion?

      Most^H^H^H^H Some Slashdotters are smart enough to understand that the ends never justify the means, that this person was picked on, detained for 5 hours and subjected to an invasive search was _not_ all well and good because he got his laptop back.

      In the end, I'd put good money on this person being picked up because he was coming in from the Dom Rep rather then because he was Moxie Marlinspike. The TSA likes to pick on single males coming in from potential sex tourism destinations, perhaps because it's the low hanging fruit. Bust a few guys coming back from the Philippines with some home made porn (a pic of a naked Pinay is not hard to get) and make it look like you're doing a great job, after all who would defend these dirty sex pests (they are probably all pedo's anyway). Incompetence rather then malice, but the end result is the same.

  • by nweaver (113078) on Saturday November 20, 2010 @01:27AM (#34289308) Homepage

    I worked through this policy myself as an intellectual exercise [blogspot.com] (A protocol for China. Or Defcon. Take your pick).

    Basically, take a laptop with an easy to swap hard drive. Swap in a new drive, with a clean image, and no access credentials except to a temporary dropbox account for emergency mail and/or working set.

    Now if you are intercepted, there is no data TO capture, and you can remove all but hardware/bios trojans by a wipe and reinstall.

    As a bonus, you can just take out the drive, hand it to customs, and let them have fun with it.

    • Re: (Score:3, Informative)

      by careysub (976506)

      Basically, take a laptop with an easy to swap hard drive. Swap in a new drive, with a clean image, and no access credentials except to a temporary dropbox account for emergency mail and/or working set.

      Now if you are intercepted, there is no data TO capture, and you can remove all but hardware/bios trojans by a wipe and reinstall.

      As a bonus, you can just take out the drive, hand it to customs, and let them have fun with it.

      International corporations are already doing something quite similar to this. You carry an empty laptop with you - and download an encrypted "project package" at your destination to install any special software, and any data you need. You encrypt and upload your product data (if you need to bring it back at all) and run a program that wipes the laptop before return.

      But of course spies, criminals and terrorists would never think of doing this.

  • by VortexCortex (1117377) <VortexCortexNO@S ... t-retrograde.com> on Saturday November 20, 2010 @01:52AM (#34289436)

    I would never trust my hardware again once I had handed it over to some customs (or other government agent) goons, and it left my sight. I would rather just remove the hard drive and hand it alone over to them, at least then I wouldn't have to trash the whole thing.

    There's really no way to be 100% sure you successfully "re-flashed" the BIOS, or cleaned all hardware as some posters have said they would do. Not to mention: There could be additional hardware installed, 5 hours is a long time...

    You could tear your machine apart and inspect it all you want, but it's well known once the enemy has unfettered physical access to a device, all bets are off.

    • by the_humeister (922869) on Saturday November 20, 2010 @02:44AM (#34289622)

      Paranoid much? Shit, you could say that about new hardware as well. How do you know the manufacturers didn't put some virus/trojan, inadvertently or maliciously, on the devices you bought (especially now that most of those devices are made in China)?

      • by dbIII (701233) on Saturday November 20, 2010 @03:13AM (#34289688)
        You don't just have to be paranoid about government interference to be worried when there's ordinary crime along the lines of the ordinary thefts that we already see.
        For instance the low paid TSA guys could be paid kickbacks to put keyloggers on there so that criminals can get credit card numbers. The lack of accountability would mean that it would be a very long time before somebody in that position would be caught even if there was a lot of evidence.
        Personally I think we should get rid of that entire knee-jerk reaction organisation and replace their security guard style workforce with professional law enforcement with a clear chain of command and true accountability as was recommended in the first place. We wouldn't need anywhere near as many people and it would not cost as much. The only downside is it takes time to train such a group. We've got time, we've already had seven years of the sort of security staff you have to prevent shoplifting.
      • Re: (Score:3, Insightful)

        by metrometro (1092237)

        Logging things done by a random buyer isn't the same as logging things by the guy we'd really like to know more about.

    • by lakeland (218447) <lakeland@acm.org> on Saturday November 20, 2010 @03:04AM (#34289658) Homepage

      Right, and if you read the CNET article he mentions that he's already disposed of all the checked hardware.

      He also mentioned that the extra cost of hardware + embarrassment of missing meetings due to being detained and missing flights means his business is losing contracts and money, and he's thinking of refusing international clients. Maybe that's the government's goal.

      • Re: (Score:3, Insightful)

        by Anne_Nonymous (313852)

        >> embarrassment of missing meetings due to being detained and missing flights

        As disgusting as this whole episode is, the detention probably works for him, rather than against him. I didn't know this guy's name until a few days ago. Additionally, how many people do you know who are such security studballs that the whole US Government is out to intercept them at every turn?

    • Re: (Score:3, Insightful)

      by Dan541 (1032000)

      With the price of hardware these days it's hardly worth even getting it back. Once it's compromised; it's compromised.

      I agree, once it's been in the hands of an adversary you just can't trust it any more. I would purchase a new laptop over the counter reload the encryption and restore from secure backup.

      I had to do this recently after having a system stolen. Fortunately everything was switched off and demounted at the time but it has made me think about the possibility of running remote wipe software so tha

  • Travel Tip (Score:5, Interesting)

    by Anonymous Coward on Saturday November 20, 2010 @02:05AM (#34289490)

    I travel to the US a lot for business. What I do is Fedex my "real" hdd to the hotel I'm planning on staying at, usually 1 day before travel to the US is enough for it to be there waiting for me when I arrive at check-in (obviously its an encrypted disk).

    I travel with my laptop, with a small capacity hdd that has a clean install, some common oss apps installed, some bogus documents downloaded from scribed, some fake e-mail accounts with credentials saved in firefox and some typical surfing history. The aim is to make them feel like they've found the stuff they're looking for and that there isn't anything worth pursuing - rather than trying to be a smart-ass that makes them even more intent on performing those unwanted rectal examinations. I've had my laptop taken twice in the last 3 years, and on both occasions after providing access details, I was given the laptop back within 5-10mins, other people i know that tried to screw over the TSA/customs by not providing all the access details they wanted, ended up never seeing their machines again.

    Though now with the new scanners at play in the airports, I'm trying to reduce my travel to the US to a minimum. If I have to travel, I charge a premium for the various inconveniences endured, most clients are sympathetic and pay without much fuss.

    • I What I do is Fedex my "real" hdd to the hotel I'm planning on staying at, usually 1 day before travel to the US is enough for it to be there waiting for me when I arrive at check-in (obviously its an encrypted disk).

      Nice tip, but given the latest Al Qaeda shenanigans in Yemen with printer cartridges, shipping hard disk drives will probably be forbidden real soon.

      I have traveled to the US on business a lot before 9/11 and a few times after 9/11. The difference in "security" is frightening . . . I'd call it "siege mentality." When the security folks look at my laptop, and I show them my company ID badge, that gets me passed through, no questions asked. But I have to wonder, what do you do if you work for Airbus, and

  • by mykos (1627575) on Saturday November 20, 2010 @02:36AM (#34289592)
    I can't think of a single thing that could be carried on any laptop that warrants the harrassment of millions a year.

    Even if a 9/11 scale event happened every single year, it would take more than four years to match a single year of alcohol-related deaths in the U.S.
  • by Chas (5144) on Saturday November 20, 2010 @05:16AM (#34290074) Homepage Journal

    When traveling out-of-country, do not:

    Bring your best laptop with you. Bring a cheapie that you don't mind losing. This way you don't have any real qualms about abandoning it when these ass-wipes pull this.
    Keep anything important on the machine, encrypted or otherwise. Have an internet dead-drop you can push things to before crossing borders.
    Leave anything important on the machine. Use a decent file shredder to eliminate it.

In order to dial out, it is necessary to broaden one's dimension.

Working...