Long-term laptop confiscation on re-entry into US

[AZRedhawk44]

http://news.yahoo.com/s/livescience/20110407/sc_livescience/laptopsandotherelectronicsmaybeseizedonentrytous


Why does this type of noxious precedent always have to be established by scumbags trying to get away with something?


Registered sex offender goes to Mexico for vacation.  Comes back.  Laptop has a bunch of password protected files on it.  Customs takes it and sends it 170 miles away for forensic analysis.  They find kiddie porn.  They charge him.  He goes through an appeals process to the 9th Circus, who say "the border isn't the US, you aren't granted your rights until you're in the US, so screw you."

Password protection...

I sure hope it was a bunch of weak-ass ZIP files and not something more robust like TrueCrypt volumes.  I'd hate to think the .gov can crack a TrueCrypt volume.


A personal aside...

I do not travel where I might have my laptop examined by TSA or Customs, but if I did, I would store my "working" OS at home via CloneZilla and load a sterile OS with nothing interesting on it.  And then TrueCrypt a reasonable-sized container for any documents I might want to keep secure.  And it would not have a .tc file extension.

/home would be on its own partition on the disk (/dev/sda2).

When at my destination, I would create a new user account on that computer and do all my work on that account.

When leaving my destination, that user account would be destroyed and the /home partition would be issued:

sudo dd if=/dev/urandom of=/dev/sda2

Then a new clean sterile user account created back on top of the /home partition, so ANYTHING in the partition would be unreadable.  Recovering so much as my net browsing history would require significant resources, and be unrewarding.  Let alone finding and accessing the secure volume.

[CNYCacher]

Why not just make sda2 a TC volume and use TC to mount it on /home?

Then you could do hidden / not hidden volume.  Not hidden for normal stuff.  Hidden for stuff you don't want people to see.

Hell, you could leave it unmounted normally, have your user folders inside /home (on sda1) and mount over them with TC'd sda2 when you want.

I believe there is no way to prove that a partition filled with random data is actually a TC volume.

[Perd Hapley]

Registered sex offender goes to Mexico for vacation.  Comes back.  Laptop has a bunch of password protected files on it.  Customs takes it and sends it 170 miles away for forensic analysis.  They find kiddie porn.  They charge him.  He goes through an appeals process to the 9th Circus, who say "the border isn't the US, you aren't granted your rights until you're in the US, so screw you."

Is that really what they said? Do our courts really believe that our rights depend on our geographic location? It looks like they just said that you can expect to be searched when you cross an international border.

In upholding the government’s argument, the Ninth Circuit Court noted that several other courts including the U.S. Supreme Court have recognized that by definition all border searches are reasonable because they occur at the border.

Of course, we might still ask why being a sex offender means they should scan your laptop, or why password-protected files are suspicious. 

[erictank]

Is that really what they said? Do our courts really believe that our rights depend on our geographic location? It looks like they just said that you can expect to be searched when you cross an international border.


Of course, we might still ask why being a sex offender means they should scan your laptop, or why password-protected files are suspicious. 

Re: the last segment of your final sentence - how's about, because I've got personal information which is no one's business but my own?

That's *MORE* than enough reason to keep my private files private all by itself.

Oh, if you have some valid, reasonable, articulable suspicion of ACTUAL WRONGDOING, do the temporary seizure thing and get a warrant to crack the hard drive.  Otherwise?  GET BENT.   Crap like this makes me want to encrypt gigabytes worth of nothing in particular (clip art and grocery lists, say) using the most secure method I can easily get hold of, simply because someone somewhere will want to waste their time uncovering evidence of... nothing whatsoever.

From homelandstupidity.us: "I reject the notion of guilty until proven innocent, and every American should as well. If you think I’m guilty, you prove it. I have nothing to prove. And I may have nothing to hide either, but you can’t see it." - where's my "enthusiastic applause" icon?

For more sophisticated analysis: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=998565 ("'I've Got Nothing to Hide' and Other Misunderstandings of Privacy ", Daniel J. Solove, George Washington University Law School).

[AZRedhawk44]

Why not just make sda2 a TC volume and use TC to mount it on /home?

Then you could do hidden / not hidden volume.  Not hidden for normal stuff.  Hidden for stuff you don't want people to see.

Hell, you could leave it unmounted normally, have your user folders inside /home (on sda1) and mount over them with TC'd sda2 when you want.

I believe there is no way to prove that a partition filled with random data is actually a TC volume.

So assuming I've got /dev/sda1 consisting of the / filesystem, and I create a /home folder in it.

I've got a user called azredhawk44 and his home drive is /home/azredhawk44.

I've got spare room on the drive to create more partitions, and I create a TC volume.

I format that volume ext3 and mount it at /home.

I create another user called sneakyuser.  He gets a home folder of /home/sneakyuser when the TC volume is mounted.

When /dev/sda2 is mounted, does /home consist of:
/home/azredhawk44
/home/sneakyuser

Or does /home/azredhawk44 temporarily disappear?

And... is sneakyuser visible as a user in the /etc directory?  Perhaps /etc/passwd?  And since his account would have no immediately visible home directory under /home/sneakyuser without the TC volume mounted, cause a forensics analyst to become more motivated to seek out alternative homes?

[Nightfall]

I just went with a clean, alternate Ubuntu install on my laptop after nuking the drive with 4 passes of a PRNG stream. Using the alternate installer allowed me to very easily encrypt the whole HDD using 256-bit AES. Hopefully, considering I have a fairly strong (read random numbers/symbols/letters) password, that would be enough to keep out thugs, of both the normal and gov't type.

Of course, I'd find it terribly amusing to be there when, after all the effort and time to crack the encryption/password, they found absolutely nothing even remotely illegal, or of any interest. 

[Perd Hapley]

Re: the last segment of your final sentence - how's about, because I've got personal information which is no one's business but my own?

That's what I'm sayin'. I think you read me wrong.

[erictank]

That's what I'm sayin'. I think you read me wrong.

If that's what you were saying, then I did indeed.  Apologies.

[zahc]

http://www.aclu.org/constitution-free-zone-map

99% of Californians live "on the border".

[RevDisk]

A lot of companies are being faced with this.  Especially because Export Control laws also apply.  At my old company, we had a form that we ginned up.  Certifies that either no export controlled data is present, or it is and cites the relevant citations for exemption.  We told folks to carry two copies, as Customs can and does snag it without offering a photocopy.  Importing or exporting export controlled data (and you'd be surprised what is...) is a felony.

Folks just don't seem to understand that US export and import regulations apply to everyone, as it is the law.  I spent a YEAR sharply focused on it, and I was NOT competent to a reasonable degree.  I'd estimate there are perhaps 60,000 people in the world (including Customs Brokers and CBP officers) that I would consider competent to know, to a reasonable degree, whether they are fully in compliance with all relevant US export and import regulations when traveling or shipping in and out of the US.  The laws are that cumbersome. 


It's the position of the US government (all three branches) that they have near unlimited power over activities at the US border, and unfortunately the Constitutional sorta, kinda backs them up.  Well, they have more of a leg to stand on than usual anyways...


After spending an entire year with dealing with this, for the love of the Gods, do NOT carry anything other than sterilized electronics across the border.  And I mean, thoroughly sterilized.  I'd go so far as to recommend using a new and sterile cell phone.  My minimum recommendations are a properly sterilized laptop (disk completely wiped with random data, reinstalled with just the base OS and minimum necessary applications) and VPN/RDP/SSH back to the US for your data.  Once completed overseas, VPN/RDP/SSH your files back and rewipe your laptop with random data.  If you're really clever, you do your work on a server/computer back Stateside so the only data that goes overseas is the information on your screen and on your video buffer, preferably heavily encrypted.

While not optimum security, for the average user, on return to the US I just recommend deleting the files completely and using a scrubber to make sure the files are really gone.  Customs gets irate/suspicious when you bring a dead laptop with you back to the States and most folks don't haul OS install disks with them overseas.

This isn't paranoia, this is SOP for most intelligent persons or corporations.  You are a fool if you DON'T take the above precautions, regardless of whether or not you believe you have something to hide.  If you're reading this, even if you are a lawyer, there is a 99.9999% chance you are thoroughly incompetent to understand the laws in question and you are still bound to follow them.  I know this, because I am one of those incompetent persons.

[CNYCacher]

So assuming I've got /dev/sda1 consisting of the / filesystem, and I create a /home folder in it.

I've got a user called azredhawk44 and his home drive is /home/azredhawk44.

I've got spare room on the drive to create more partitions, and I create a TC volume.

I format that volume ext3 and mount it at /home.

I create another user called sneakyuser.  He gets a home folder of /home/sneakyuser when the TC volume is mounted.

When /dev/sda2 is mounted, does /home consist of:
/home/azredhawk44
/home/sneakyuser

Or does /home/azredhawk44 temporarily disappear?

And... is sneakyuser visible as a user in the /etc directory?  Perhaps /etc/passwd?  And since his account would have no immediately visible home directory under /home/sneakyuser without the TC volume mounted, cause a forensics analyst to become more motivated to seek out alternative homes?

Anything you make in /home would disappear when you mount a drive into /home, so when the drive is mounted, the all you would see is /home/sneakyuser.  When you unmount the TC vocume, you would see /home/azredhawk44

because of this, I see no reason why you can't use the same username for both users, and therefore avoid creating a new user

[erictank]

http://www.aclu.org/constitution-free-zone-map

99% of Californians live "on the border".

So does my entire family - most of them in NYS, me in VA, my sister in IL.  All of us within the "Constitution-free zone".

[De Selby]

This isn't paranoia, this is SOP for most intelligent persons or corporations.  You are a fool if you DON'T take the above precautions, regardless of whether or not you believe you have something to hide.  If you're reading this, even if you are a lawyer, there is a 99.9999% chance you are thoroughly incompetent to understand the laws in question and you are still bound to follow them.  I know this, because I am one of those incompetent persons.

This is true.  It's one thing to get a specific question and investigate it - usually you can come to an answer, even without a lawyer.  It's another thing to go through your kit and try to spot all the things that could be an issue in advance.

The best thing you can do, IMHO, is be relaxed and confident that you aren't doing anything illegal as you cross the border.  That way you won't fidget and sweat, and 99% of the time that means no one will take a second look at your laptop. 

[Perd Hapley]

http://www.aclu.org/constitution-free-zone-map

99% of Californians live "on the border".

Oh, I wasn't aware of that issue. If the ACLU is at all accurate about that, then maybe I am being too charitable to the judges.

[KD5NRH]

Of course, I'd find it terribly amusing to be there when, after all the effort and time to crack the encryption/password, they found absolutely nothing even remotely illegal, or of any interest. 

Even better, if you don't log in every x hours, have it randomly swap some bits here and there to completely mangle the encryption.