Securing Your Notebook Against US Customs

Nethemas the Great points out a piece from Bruce Schneier running in the UK's Guardian newspaper with some tips for international travelers on securing notebook computers for border crossings. A taste of the brief article: "Last month a US court ruled that border agents can search your laptop, or any other electronic device, when you're entering the country. They can take your computer and download its entire contents, or keep it for several days. ... Encrypting your entire hard drive, something you should certainly do for security in case your computer is lost or stolen, won't work here. The border agent is likely to start this whole process with a 'please type in your password.' Of course you can refuse, but the agent can search you further, detain you longer, refuse you entry into the country and otherwise ruin your day."

This is why you make sure...

...that your desktop is the Goatse guy and you have 14 videos of horse porn set to auto-play the moment your laptop gets opened. If you're going to snoop through my stuff in public, then the whole terminal is gonna get their money's worth, you fascist bully-boys.

Re:This is why you make sure...

And in addition the sound must be played at maximum volume. Including the "TaDa [bedug.com]" in Windows or some other classic clip; "Computer Standing By... [bedug.com]"

But I think that "1 minute to auto-destruct [bedug.com]" can be a bit too bad.

Re:This is why you make sure...

Security by obscenity?

Mess with them

Make a folder called "Terror Plans" and fill it with images of cute, cuddly kittens.

Yup

I got it in my biweekly dose of Cryptogram and found it disheartening. The GOD of security says: all you can do is make sure they wont find anything that will mess you up.

The sad thing is that citizens think this idiotic idea of checking laptops at airports serve any kind of law enforcement objective other than generalized panic and further diminishment of democratic values such as the right to privacy.

This is your government fucking people up (and "people" can be foreigners or locals entering the country), attempting to find in informations traces of delincuent activity that, if youre a two bit moron you know you can save it anyhow, in a mostly anonymous fashion on google's, yahoo's or microsoft's servers for free, and any number of services that are available today.

True criminals simply have huge botnets and hidden servers behind the huge pr0n/spam nets and they DO NOT carry incriminating evidence with them and EVEN IF THEY DID, how in hell is a custom's agent going to find them?

I mean, i have a better solution than that of bruce: change your initab so initdefault is 3, make sure that that level does NOT turn on the wifi card or any networking at all, change your shell to ASH (hopefully temporarilly) and let them have the root password, who cares.... good luck, mister customs agent.

A naive suggestion

1. Upload all of your data on a web host with SFTP support and lots of bandwidth.
2. Purge your hard drive.
3. Be politeness incarnate to the customs officer and get through fast.
4. Once inside, use any available network at your disposal to download all of your data back.

The downsides? You probably won't be able to work in the airplane, but is it worth it now that the Customs are being so much trouble?

My laptop

Is set to boot MS-DOS by default.

It's actually because I need to load a device management driver that overrides the BIOS data for the hard disk, but it may actually be worth it for them to try to fiddle around at the MS-DOS prompt...

Yes it will work.

That is what TrueCrypt is for (but don't encrypt the entire drive). Just encrypt what needs encryptin'. Set up an encrypted volume with a shadow volume inside a regular file. Call it something that looks like a system file like MSDOS.SYS or DBLSPACE.BIN or something. (That would explain the unusually large size of the file.)

So first, they would have to know you even have something encrypted (which is just a guess if they see TrueCrypt installed). Then they'd have to know what/which files was/were encrypted (which can't be determined by examining the file). Then they'd have to ask you to mount the volume and provide the password (at which time you then provide the shadow volume password, which only contains innocuous files).

I can't be the only dummy to figure that out.

Refuse you entry to the contry

Can customs officials refuse entry to an American Citizen? Can they banish me for refusing to divulge my password?

Re:Refuse you entry to the contry

Can customs officials refuse entry to an American Citizen? Can they banish me for refusing to divulge my password?

They cannot. They can only detain you "for a reasonable period of time" while they investigate what you may be carrying, but they have to justify the length of detention by some reasonable suspicion. i.e. we suspect he swallowed drugs and so can take 3 days to see what comes out the other end. But they need to back that up with why they suspect that.

Or another example is detain you and/or the computer until they can image the drive.
And they can confiscate contraband (your definition may vary).
Ultimately, you have the right to enter the country.

Corporation Lawyers

You can bet that before I type my password for a customs agent, I'm going to talk to my company's legal department. And I'll wait in the customs office as long as it takes. Or simply forfeit the laptop and put it in the trash.

The IP on my laptop is easily worth 10x more than the value of the laptop itself.

US Customs has always been like this

Having returned from my second trip to China, I still find it amazing that it is easier for me, as a foreigner, to enter China than it is for me, as a US citizen (born a US citizen to parents who were US citizens, etc.) to enter the US after a trip abroad.

I just pretty much walked right through in China - I handed them the entry form (one half of the two part form - the other half you give them when you leave) and they waved me through. Customs in China did not even ask to see my laptop, never mind read files or anything like that.

On returning to the US at Detroit International, I was given the 3rd degree by US Customs agents, and I'm a US Citizen. "How long were you in China?" (as if he couldn't tell by the side-by side entry/departure stamps in my passport) "What were you doing there?" (visiting friends) "What do these friends do for a living?" (A couple of college professors and a financial analyst)

This happened on both of my trips.

And I noticed that they were doing this to EVERYONE, not just me. (The plane had several hundred people on it.) I'd hate to see what they were doing to Chinese citizens entering the US.

I hope they realize that they are going to scare businesses away from the US if they keep this up.

I find it somewhat ironic that the captcha for this post is "undergo".

Simplest solution. Canada

Have all your US and overseas clients meet each other in Toronto, Vancouver or anywhere in Canada for that matter.

Truecrypt + Thumbdrive = Hidden OS

There are a couple of ways to hide your data; one is to have two Truecrypt volumes, one hidden and one standard. This is easy, but it still lets the customs agent know you are using Truecrypt. This may not be a problem in the US (right now) but what about other countries where simply knowing about a program like Truecrypt could look suspicious?

This post [truecrypt.org] on the Truecrypt forums describes a way to install two OSes, one for show, and one hidden. Unless there is a Truecrypt rescue CD or bootable USB thumbdrive inserted the system will boot to a normal Windows desktop. This method would hold up to any casual sort of inspection, such as those customs agents carry out dozens of times per day. There are a couple of traces that would need to be removed in order to actually have "plausible deniability", but to me not having the questions asked in the first place is preferable to being able to deny one of the potential answers.

It's sad that you might need to do things like this, but there are often technological solutions to social problems.

Re:Dual Boot

If they choose to store the contents of your hard drive for later analysis, not at all. Nor will it protect you against minimally-clever forensics tools.

It depends on what, in particular, you're concerned about. As far as I know, they don't currently routinely search laptops, so it'd be speculation to guess at what a routine search they don't do would miss.

Re:Dual Boot

if your under suspicion for who you are then you are pretty well fucked. But if your just worried about a random security search and wanting to keep certain data private you only need to get past that first step because they will not spend the money to dig deeper even if they do copy your hard drive.

if you are a known individual (person of interest) and you expect to be stopped at the border, don't carry sensitive material with you. Hell, just mail a flash drive.

Re:Dual Boot

Likely "pretty good". It all depends on how nosy the Customs Agents want to be. The vast majority of the time, they just stare at the laptop, maybe make you boot it (but that's TSA's responsibility, really) and let you wander off. The issue is that you don't know when the Agent 1) had a bad night 2) thinks you're a smartass / druggie / on The List or 3) anything else (no probable cause here).

If they want to clone your hard drive and disassemble it later, your secondary boot OS is going to stick out. Not that it is unusual for anyone to have more than one OS on a hard drive, but it won't be hidden. Remember, they essentially have physical control of the computer. "They" win. Unfortunately, it comes down to 1) security by obscurity or 2) nothing to hide.

Roll up your sleeves and bend over.

Depends upon how proficient they are.

They can also image your drive. As Bruce says, the easiest way to avoid this is to not have your data on your laptop. Put it on something else.

Re:Dual Boot

Works very well. I had to set this up due to being detained at the border for several hours because they didn't know linux. They keep the laptop, computer plus some external drives and let me go. Still working on getting them back, hence anonymously. Bought a new laptop after that, set up the dual-boot with short times to select something other then windows and no log-in required. Been inspected several times after that with no problems.

Not dual boot; the network IS the computer

Set up a Windows partition and a Linux partition, set it to boot to Windows by default, keep all your data on the Linux partition. How well would that work, I wonder.

Probably pretty well unless they're doing full-disk imaging, in which case the Linux partition is still in their hands when you walk away. Best thing to do is not to take a *computer* with you when you travel, but rather take a *terminal* with you (or find one), and use a secure connection to your computer, safely still at home, and then access your data, accounts, apps, etc. over that secure connection.

Re:Dual Boot

Of course not. The Department of Homeland Security doesn't hire any lower than a Master's degree.

Re:Dual Boot

Yup. Set the GRUB timeout to 0; you can only boot Linux iff you hold escape.

Re:Dual Boot

>>>"The border agent is likely to start this whole process with a 'please type in your password.' Of course you can refuse, but the agent can search you further, detain you longer, refuse you entry into the country and otherwise ruin your day."

Sounds like a small price to pay in order to protect my right to liberty. Just because the government demands access does not mean I have to comply.

Other people have paid a far higher price for liberty ("the full measure of devotion" aka death).

Re:Not enitrely true...

I have been denied access to countries for less than not providing a password. They can pretty much turn you away because they feel like it.

Re:TrueCrypt

People here keep talking about encrypting your files. Fine, but the second the Customs Guy figures out you have encrypted content on your laptop, you can kiss it good bye. They *will* keep it. You may not see it again for several years.

If you're going to carry stuff over the border you don't wan't The Man to look at, put it on a thumb drive and attach it to your keys.