Border Agents Fail To Delete Personal Data of Travelers After Electronic Searches, Watchdog Says (gizmodo.com) 89
The Department of Homeland Security's internal watchdog, known as the Office of the Inspector General (OIG) found that the majority of U.S. Customs and Border Protection (CBP) agents fail to delete the personal data they collect from travelers' devices. Last year alone, border agents searched through the electronic devices of more than 29,000 travelers coming into the country. "CBP officers sometimes upload personal data from those devices to Homeland Security servers by first transferring that data onto USB drives -- drives that are supposed to be deleted after every use," Gizmodo reports. From the report: Customs officials can conduct two kinds of electronic device searches at the border for anyone entering the country. The first is called a "basic" or "manual" search and involves the officer visually going through your phone, your computer or your tablet without transferring any data. The second is called an "advanced search" and allows the officer to transfer data from your device to DHS servers for inspection by running that data through its own software. Both searches are legal and don't require a warrant or even probable cause -- at least they don't according to DHS. It's that second kind of search, the "advanced" kind, where CBP has really been messing up and regularly leaving the personal data of travelers on USB drives.
According to the new report [PDF]: "[The Office of the Inspector General] physically inspected thumb drives at five ports of entry. At three of the five ports, we found thumb drives that contained information copied from past advanced searches, meaning the information had not been deleted after the searches were completed. Based on our physical inspection, as well as the lack of a written policy, it appears [Office of Field Operations] has not universally implemented the requirement to delete copied information, increasing the risk of unauthorized disclosure of travelers' data should thumb drives be lost or stolen." The report also found that Customs officers "regularly failed to disconnect devices from the internet, potentially tainting any findings stored locally on the device." It also found that the officers had "inadequate supervision" to make sure they were following the rules. There's also a number of concerning redactions. For example, everything from what happens during an advanced search after someone crosses the border to the reason officials are allowed to conduct an advanced search at all has been redacted.
According to the new report [PDF]: "[The Office of the Inspector General] physically inspected thumb drives at five ports of entry. At three of the five ports, we found thumb drives that contained information copied from past advanced searches, meaning the information had not been deleted after the searches were completed. Based on our physical inspection, as well as the lack of a written policy, it appears [Office of Field Operations] has not universally implemented the requirement to delete copied information, increasing the risk of unauthorized disclosure of travelers' data should thumb drives be lost or stolen." The report also found that Customs officers "regularly failed to disconnect devices from the internet, potentially tainting any findings stored locally on the device." It also found that the officers had "inadequate supervision" to make sure they were following the rules. There's also a number of concerning redactions. For example, everything from what happens during an advanced search after someone crosses the border to the reason officials are allowed to conduct an advanced search at all has been redacted.
Confirmation is nice but... (Score:3, Informative)
Raise your hand if you didn't expect that one...
The still untried solution awaits
Re:Confirmation is nice but... (Score:5, Insightful)
Let's all guess why they are keeping it secret. I'll bet pretty much anything, that a bunch of customs agents where going through attractive women's photo albums and pilfering images used for sexting, oh yeah and doing it a lot.
Re: (Score:2)
Re: (Score:1)
It's a sad state of affairs as our worst tin hat paranoiac fantasies come true.
Let this be a reminder that all those silly "privacy policies" out there are just as phony.
Re: (Score:2)
Let's all guess why they are keeping it secret. I'll bet pretty much anything, that a bunch of customs agents where going through attractive women's photo albums and pilfering images used for sexting, oh yeah and doing it a lot.
Remember, these are the same people who steal the iphones and laptops from your checked baggage.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Good luck enforcing that when you're facing the TSA at an airport and want to get somewhere.
Re: (Score:3)
They have no accountability, they do not get punished whatever misdeeds they do, they have wayyyy too much power. Of course they would do this.
Re: (Score:2)
And, most importantly, when they've gathered this information, they think it is THEIRS.
And that is what needs to be changed.
Re: (Score:2)
Indeed. Very much so.
Re: (Score:3)
Re: (Score:1)
Re:When will people wake up? (Score:5, Informative)
The Constitution only applies to U.S Citizens.
No it doesn't. The Constitution does not confer rights. It places restrictions on the government. The First Amendment says: "Congress shall make no law.... It doesn't say "no law except on foreigners". No where in the Bill of Rights does it say they only apply to citizens.
These searches are applied to non citizens trying to gain entry to our country.
Wrong. Anyone, citizen or non-citizen, is subject to search when crossing a border, or within the border area.
Re:When will people wake up? (Score:4, Informative)
Food, water, health care, visits by their embassy.
People just have to stop supporting/funding banned groups when outside one the USA.
Been part of a banned group and not mentioning that fact when asked is a crime.
Supporting a banned group and related funding is a crime when asked about any such activity.
Traveling in a nation that supports banned groups and not telling the US gov about that extra "holiday" when asked is a crime.
Having images taken with wanted criminals who are active members of a banned group
Creating a fake identity to hide past that had a person supporting banned groups.
Banking for banned groups.
Transferring tech and money to nations that have sanctions imposed.
No loss of rights for a non citizen/illegal migrant. When the US gov asks questions when entering the USA, don't hide past events and expect to be allowed in.
Thats why the search of digital data/images/gps is so important. It finds people who support banned groups outside the USA. People who then lie to the US gov.
Re:When will people wake up? (Score:5, Insightful)
Re: (Score:2)
AC that "right to not being frisked" has been before many a US court over generations and decades. The US gov finds it can have a secure border.
Two out of Five ain't bad... (Score:4, Interesting)
I'm surprised that two out of the five actually did delete the data.
I wonder how much of this is "Quick Format" and "Hey we found old data here!" kind of things?
But I think we buried the lead here. What really concerns me is that the documentation about the searches and why they where conducted is woefully lacking (see page 6 of the PDF). Seems that this process is ripe for abuse and that the controls in place for keeping this on the up and up are being ignored.
Think of it this way.. IF nobody is documenting why and when this is being done, there is no real proof and no real way to get it to stop if it really is out of hand.
Re: (Score:2)
Lets be realistic. They search the cute foreign girls on 'advanced' mode and keep the thumb drives to bring home to search for nudes at night.
You know it's happening.
This.
Just like they make cute girls go through the body scanner a second time and call all their friends over to make really sure she's not hiding anything.
WTF (Score:1)
The USA is actually hard copying data from travelers phones? Jesus I'm glad I stopped flying through the US 5 years ago.
Re: WTF (Score:1)
We're glad too.
Why would they. (Score:3)
Not so Random search... (Score:1)
Well of course every hot chick is a potential security threat...
So... (Score:4, Interesting)
Re:So... (Score:5, Informative)
What's to stop you encrypting your data and storing it somewhere on the internet instead of taking a physical copy through a checkpoint?
If a terrorist wants to bomb a plane, he's going to need to smuggle a bomb past security, so checking people for bombs isn't exactly a stupid idea (whether the balance between safety, security, privacy, and theatrics is good is a whole different matter). But if he's got some "terrorist data" to move around, why would he physically carry it?
Re: CBP is tasked to protect against any illegal i (Score:2, Interesting)
It's a gotcha procedure, and has nothing to do with protecting anyone or anything. It's simply about catching people in an arbitrary violation of rules in order to extort money or exert power.
That sort of arbitrary game playing is the very essence of government corruption, it's simply a matter of scale and scope. They get away with the little shit they pull, and keep pressing the boundaries until the gotcha games exceed some critical threshold - either populist in nature, or someone with sufficient power an
Re: (Score:2)
"But if he's got some "terrorist data" to move around, why would he physically carry it?"
Because sneakernetting doesn't get you a JDAM visit in the middle of the night. Taliban used sneakernet for that very reason.
The internet cannot ever be considered secure (let's not pretend otherwise) so using it is asking to get whacked.
Re: (Score:1)
With wifi just about everywhere and the possibility of setting up VPN tunnels back to private storage, why is there any reason to keep anything on your phone at a border crossing? upload before crossing, Wipe the device, redownload once you're across.
Re: (Score:3)
Moral of the story, never remove the SD card from your phone before crossing the border. This manoeuvre is probably far more painful if there's nothing for them to find, and yet they keep looking.
Re: Define 'Crossing The Border' (Score:1)
They can and they do. You might be able to challenge it in court though, but donâ(TM)t expect that to be easy.
So... (Score:5, Insightful)
One more reason not to travel to the US, even to tourism.
Re: (Score:3)
The US gov wants a person to lie directly when asked a simple question.
The US mil and its support in other nations already know who is entering the USA and what they did globally while on "holiday".
The questions and search at the international border allows for people tracked globally by the US mil/CIA to be questioned as a very random "event".
Such peop
Re: (Score:1)
With dozens already to choose from, what's one more? Only a fool would willingly set foot in that sh!thole of a country.
Re: (Score:3)
In this case, for foreigners with sensitive business documents, the CIA and NSA would be seriously remiss in their duties if they didn't try to mine such info at every opportunity and analyse it 6 ways from Sunday to give the US any edge in security (and lets be honest, any edge in prosperity too)
Terrorists, at least, tech savvy terrorists, wouldn't have sensitive data on
Re: (Score:3)
And yet, there have been those on this site who argue that making a copy isn't "theft" because the owner isn't deprived of their copy.
That's because it isn't theft. Theft is where you take someone from someone and they are subsequently deprived of it. Copying someone's data without their permission is not theft, it is violation of copyright. We have an entire separate body of law for copyright specifically because it is different from theft. Were it otherwise, we could simply have different sentencing guidelines under the existing laws governing theft to cover theft of data. But it isn't, so we don't, because you can't.
Re: (Score:2)
No, that's called kidnapping.
Re: (Score:2)
No, that's called kidnapping.
Touche. Although in my defense, it's also called a typo.
Why not? (Score:2)
Thumb drive prophylaxis (Score:5, Insightful)
So let me get this straight.
Some random customs officer takes a USB stick and puts it into someones laptop. A laptop with total control of its own I/O systems, peripheral ports, and software execution environment. Maybe they try to run some custom software that exists on the USB stick. Maybe they try to boot your machine off their USB stick, or have it somehow run something from the USB stick before you host OS takes control.
Then they take out the USB stick, hopefully wipe it off, and put it into someone else's laptop and do the same thing?
And they think this is a good idea?
I'll leave it up to the reader to see if they can find the problem with this.
Re: (Score:2)
I'd assume that a machine CBP touched should be immediately destroyed. I have no faith that they haven't installed something or that they may have made security mistakes that allowed the machine to be compromised. I'd probably tell them to keep it.
Re: (Score:1)
I've heard from security folks that standing policy for Dutch govt. Officials is to only use disposable devices when going into China any Russia. I think they've extended that to the USA. For the EU defense industry the US was already off limits for hardware across the border after a few incidents in the late 90's.
If I ever travel to the USA or China, my phone will be clean. Facebook... I will close it soon. Have to go to China next year and they also like to grab a copy of your info.
Twitter is no problem.
Re: (Score:1)
... and they've never shown any interest in any of my devices.
I would be insulted by this. This should make you take a step back and review how you're living your life.
Re:Thumb drive prophylaxis (Score:5, Interesting)
TALK ABOUT BRAGGING RIGHTS. It's xkcd's Bobby Tables gone hard core.
(innocent look) Does any one know if DHS sanitizes its data inputs?
Re: (Score:2)
Re: (Score:3)
A "bad actor" could also copy whatever was available on the DHS USB drive from previous scans, in hopes of getting useful into/pics/method to embarrass DHS. If there's a high value (or hot) target, they could even just get in line behind them in hopes of getting this data.
Re: (Score:2)
I wonder... (Score:2)
Plus, is anyone making sure that these thumb drives aren't growing legs? The DHS doesn't have a good track record there. There has been apparently a lot of cases of valuables
So... better to not carry devices at all then. (Score:1)
I don't travel often and generally refuse to fly when I do, seeing how air travel has devolved to treating passengers like livestock over the past couple decades. Is there even a "safe" way to travel in and out of the U.S. with any devices (laptops, cellphones) at all? Seems one would be better served by carrying *nothing*, and procuring necessary (disposable) devices when at destination, and discarding them before return trip. If I have nothing on me or in my luggage that has digital content at all, the