FredAnderssen

From Techdirt:

Judge Not Impressed With Government's Warrantless 921-Page 'Peek' Into A Suspect's Cellphone:

And since everything hinged on the search for money:

Please read the rest of the article to see what the court had to say about the warrantless fishing expedition carried out on this fellow's iPhone.

WillCAD

I'm particularly impressed by one of the comments after the article:

That sums up the problem with law enforcement in this country in a single, concise sentence:

Many of them don't see their jobs as 'upholding the laws' at all, rather they believe that it's their jobs to 'catch/stop the bad guys'.

It's brilliant, and the more you think about it, the more you realize how ingrained that attitude is. It's the Richard M. Nixon school of thought - "If the president does it, then it's not illegal!" So if a LEO does something, no matter how much it breaks laws, rules, or policies, as long as it's in the process of catching a bad guy, it's okie-dokie. The end justifies the means.

Simply brilliant, and horribly disturbing to realize.

GUWonder

And the same sort of culture is deeply engrained in American intelligence services, civilian and military.

Boggie Dog

And all other federal employees from the former Secretary of State, IRS employees, FLEO's and of course my favorite TSA in its entirety.

Monking

I understand this a grey area and there are conflicting reports online but I haven’t found a single report of a US Citizen’s experience of what happens if they refuse to provide a passcode to their phone. Is there anyone here who did so and what happened next?

gfunkdave

CBP can't prohibit a US citizen from entering the country, but they can confiscate the phone for an indeterminate length of time.

Better idea would be to erase the phone before going through customs, and then restore from backup once you're back home/in office. They can't demand a passcode for information on a phone that doesn't exist.

TWA884

There is extensive discussion of at least one such incident in this thread:

KDS777

I always wipe my electronics before I travel across any border, and never travel with any of my other devices that may have been used to access or store anything that any other foreign service may find objectionable in their own minds.

jphripjah

Yes. The officer asked to me enter the passcode to my phone. I said no. Hey said "We'll seize it." I said "fine."

They didn't seize it.

At least in the 9th Circuit, they can't seize a phone to perform an off site forensic search unless they have reasonable suspicion of criminal activity.

CBP did release a policy earlier this year suggesting that they can "exclude" your device from entering the USA if you don't give them the password.

Michael A. Williams

I carry a crappy little flip.

Randyk47

I have to ask if we have any idea how often does CBP ask/demand to examine devices? Does there appear to be pattern like some kind of traveler profiling, certain itineraries, etc? The reason I ask is that since this practice went into effect we’ve traveled back from Europe twice and Mexico once and never been asked about our devices. I was actually thought maybe our last trip that involved a lot of travel in the Middle East might be a tripwire so I took a hard look at sites we might have visited on line and actually wiped our searches, history, etc., just in case.

FredAnderssen

It hasn't happened to me (yet), but I always change my iPhone and iPad from a 4-digit password to 20-digit alphanumeric* before entry to the U.S. I'm also ready for a confiscation if they wish, so I sleep like a baby before landing at MSP.

*Cracking the iPhone:

LondonElite

phltraveler

If customs really wants your phone or PC, they will take it and contract out cracking it. They can't deny a citizen entry, but they can confiscate devices. If you're really paranoid (or more politely, just security conscious), it's not unreasonable to take precautions. That being said, the number of seizures is exceedingly small, and new guidelines in 2018 are more restrictive on border searches.

If you use a modern Samsung or Apple device and have device encryption enabled (default on newer iOS/Android versions) with a sufficiently strong passcode and incorrect entry attempts wipe (generally the latter is a default) it's a good start. However, the software is basically validating the PIN (for the Apple devices since iPhone 5S except the iPhone 5C and iPad Air 2 & later, a chip called the secure enclave is in the middle). It's a stronger protection to enter customs with your device off as it ensures the full encryption passcode is not loaded into device memory. Depending on how devices like the GrayKey (post #8) work it might or might not prevent passcode bruteforcing, but not having the key to decrypt loaded into device memory would increase the attack surface. Going with a dumbphone or wiped smart device could be more secure, and then restore from cloud at arrival.

(The fact that Graykey devices require more time to crack more complex passcodes suggests to me that they have figured out some way to prevent the secure enclave on iPhone/iPad from incrementing the incorrect passcode attempt counter up but the end result is just good old fashioned bruteforcing but whether or not that works if the device is freshly booted/encryption key is not in memory as a result is not public knowledge).

If you're using a Windows PC, Bitlocker with TPM will generally preload the encryption key and just have the password screen. For additional protection, you can use group policy to restrict the TPM from loading the relevant key for encryption to device memory until a valid username/password for the system is entered (general partition for system is encrypted, small partition for logon screen is not, TPM throttles logon/bruteforcing attempts). Encryption that skips the TPM and just relies on an encryption key being correctly entered at startup may be more secure (in theory, assuming the key is strong enough).

As a US citizen, upon request from CBP I would personally refuse to decrypt personal devices and would offer CBP to contact my employer on authorization to decrypt any corporate devices (by putting the decision on my employer, the liability for the consequences of choosing to comply or not with the request falls on them.)

Never been asked personally though...

taina2

Any police like entities can make demands sometimes even illegal. It is your responsibility to protect your rights. You can always sue them for a violation of your rights.