DHS can now confiscate your electronic equipment

[anygunanywhere]

The flash drive will be found when your belongings are searched.

The police are experts at searching.  They do it all the time.

Having traveled outside the country extensively I have never had my laptop confiscated. The flashdrive would do the trick and they indeed are made with encryption. DHS can probably crack that too.

The flash drives are a great idea. You can store it right next to the shiv you made from your toothbrush.

Don't you just love Patriot Act 2?

Anygunanywhere

[Standing Wolf]

Customs Deputy Commissioner Jayson P. Ahern said the efforts "do not infringe on Americans' privacy."

Lenin would be so proud!

[ilbob]

I sort of like the idea of renaming a bunch of innocent files so they have sinister sounding names.

I actually have a folder in my email inbox named "secret company information to be leaked to competitiors".

I thought I would give the company IT spies something to chuckle about.

[roo_ster]

sounds like a good reason to encrypt everything.

They may force you to give the password to get into the country.

The US court of appeals ruled properly-the government has always had the authority, constitutionally, to do whatever it wants in the way of inspection at international borders.

One danger of having a powerful judiciary is that folks get lazy-we should be pushing legislators to pass laws that prohibit this kind of invasion of privacy, instead of waiting on the courts to save us by ruling this or that tactic unconstitutional.

Yup.

But, then, I'm one of the folks who thinks Marbury v Madison was overreach that should have been smacked down like a red-headed step child.

[MicroBalrog]

One danger of having a powerful judiciary is that folks get lazy-we should be pushing legislators to pass laws that prohibit this kind of invasion of privacy, instead of waiting on the courts to save us by ruling this or that tactic unconstitutional.

For Immediate Release

August 4, 2008

Engel/Paul Securing Our Borders and Our Data Act

Washington, DC - Congressman Ron Paul is an original cosponsor of legislation introduced July 31st that would ensure that a traveler entering the United States would be subject to searches of their data and digital equipment only if a border agent has a reasonable suspicion to believe the traveler is or is about to be engaged in criminal activity.

In an August 1, 2008 front page story, the Washington Post exposed the ease with which the government can search and/or seize a traveler's laptop, blackberry, or other electronic device. A border agent can require any individual to provide access to private or other sensitive data with no cause. They can require the owner to surrender their password for encrypted data as well.

The Fourth Amendment to the Constitution acknowledges the right of the people to be secure in their persons and effects against unreasonable searches and seizures.  It is unfortunate that it takes legislation to remind border agents of this Constitutionally protected right, but it is apparent to me that HR 6702 is absolutely necessary, stated Congressman Paul.

http://www.house.gov/paul/press/press2008/pr080408.htm

[zahc]

It's so nice to see actual pro-freedom legislation introduced.

[GigaBuist]

They may force you to give the password to get into the country.

That's one of the nifty things about TrueCrypt (http://www.truecrypt.org/).

You can create an encrypted volume either in a file on an existing disk or on an entire disk itself.  You then shove some data on there, like say, gay midget porn.

You then create another encrypted volume on top of that one that'll write from the back end toward the front.  If you mount with one password you see the "easy" disk and if you mount with the other you see the "hidden" disk.

The only technical danger there is that if you remount the "easy" disk, that you want people to find, and write too much data to it you'll corrupt the "hidden" one -- so don't add any gay midget porn to it once you create the "hidden" disk.

Sounds a bit complicated, but it really is super easy to use.  The wizard walks you through the whole process and guides you along pretty well.  After that mounting an encrypted volume isn't any harder than mapping a network drive, if not even easier.  It's more like opening up a password protected file that magically becomes a virtual disk in your machine.

[AZRedhawk44]

+1 to VPN's.

Most home internet routers have a feature called "Dynamic DNS" that allows you to easily "find" your home network anywhere in the world.  For example, I had one for awhile that took my Dynamic IP address from my ISP and registered it in DynDNS as "azredhawk44.is-a-geek.com". 

Instead of having to keep track of my IP address assigned by my ISP (it could be 1.2.3.4 one day, and then immediately change with no warning to something else), my router handles that for me and updates the name registry I have via DynDNS.  It's like a speed dial on your phone.

My router then handles any data access I need.  I can remotely access the complete desktop of my PC, or publish files via FTP, or even make a windows file share available via VPN.  Heck, if I were travelling to China and needed "real" internet access I could set up a internet proxy server and send all HTTP requests to my personal computer... or remote desktop to it and browse the internet "virtually" from my home PC while at the Olympics.

No reason to travel with any data you can afford to lose at all.  Good reason to stack your computer up with false gay midget porn RickRolls that are on an encrypted file system with encrypted zip files compressing them under false file extensions and named after components of nuclear bombs.

[InfidelSerf]

Homeland Security Officers don't happen to have these on their collars do they?

Hmm not sure if there are many Kiss fans out there anymore :p

I second the ideas to use advanced encryption to protect Barry Manilow songs and teletubbie videos.

Even use steganography to embed pro liberty messages in photos and maps of tourist targets. er I mean vacation destinations.

[Harold Tuttle]

[Ben]

Hmm. I'm off to a week of SANS Security Essentials Bootcamp next Monday. I guess I'll pay extra attention during the information warfare and crypto sections. Maybe I can learn to do something that will drive the TSA guys crazy when I take my laptops through security. It would be pretty funny if their .gov agency confiscated my .gov agency's equipment.

[Harold Tuttle]

For a close encounter of the third kind,
slap a biohazard sticker on it and rig the dvd drive to puff out cornstarch

[ilbob]

These days anyone that leaves incriminating or important data on their laptop is not real bright, especially traveling abroad.

Email it to your self and then delete it from your laptop and write over the deleted files with whatever program you have that does that.

Some countries it is illegal to have photos of topless women. years in jail. other countries it is many years in jail for disrespecting the leadership or the religion of the country.

get a clean laptop and only put on it the bare minimum that needs to be there for the trip.

I heard a story once about a guy who brought a book about ancient artifacts with him on a trip abroad. When leaving, they searched him and his gear for hours because they suspected he was trying to take historical artifacts out of the country because of the book he had.

[Ben]

get a clean laptop and only put on it the bare minimum that needs to be there for the trip.

That's how my work does it. Anyone going out of the country gets a laptop from a special loaner pool with minimum, clean installs of XP, no saving data onto the laptop while you're traveling.

[RevDisk]

VPN is probably the best solution if you'll have Internet access at your destination, otherwise, the next best solution is to spread the data over multiple cards so it doesn't look interesting (bring back the old methods of uuencoding, etc) or maybe storing it as nonstandard files (rename .doc to .dll or something) before encrypting it.

Chris

Our company is changing our policies.  I'm arguing that employees should be strictly forbidden from carrying laptops or thumb drives containing any data (ie, anything that isn't the OS or pre-installed app's) whatsoever.   They get issued a laptop with the basic programs (Adobe, Office, etc) with our VPN software.  Installing anything is forbidden.  Downloading to laptop, forbidden.   Making notes in Notepad?  Forbidden.  If we have to, we'll friggin buy two computers.  One laptop and a dedicated PC for them to "work" on internationally.   No internet connection?  Turn around and come home. 

It's cheaper to eat the cost of a ticket than have our laptop sold to a competitor or eBay'd.   Probably not practical for individuals, but I don't see any other acceptable solution for mid to large businesses.

[41magsnub]

Hmm. I'm off to a week of SANS Security Essentials Bootcamp next Monday. I guess I'll pay extra attention during the information warfare and crypto sections. Maybe I can learn to do something that will drive the TSA guys crazy when I take my laptops through security. It would be pretty funny if their .gov agency confiscated my .gov agency's equipment.

great class, I did that last year and learned a lot.

[RevDisk]

Hmm. I'm off to a week of SANS Security Essentials Bootcamp next Monday. I guess I'll pay extra attention during the information warfare and crypto sections. Maybe I can learn to do something that will drive the TSA guys crazy when I take my laptops through security. It would be pretty funny if their .gov agency confiscated my .gov agency's equipment.

Let me know how it is.   Just got back from a CEH class.  Not bad, but focused too much on tools and not enough on concepts.  Tools come and go, IT concepts stick around much longer than they probably should.

[Manedwolf]

It's cheaper to eat the cost of a ticket than have our laptop sold to a competitor or eBay'd.   Probably not practical for individuals, but I don't see any other acceptable solution for mid to large businesses.

I wonder how often that's happened.

TSA hires ex-cons. Likely some who are quite familiar with things like blackmail, extortion, industrial espionage. Supplement income with old habits and skills... See someone's laptop case has a business card for ABC Corp. "Need to confiscate it". Oops, it got lost in the system. Sold to XYZ Corp for a good sum for industrial secrets.

[41magsnub]

Hmm. I'm off to a week of SANS Security Essentials Bootcamp next Monday. I guess I'll pay extra attention during the information warfare and crypto sections. Maybe I can learn to do something that will drive the TSA guys crazy when I take my laptops through security. It would be pretty funny if their .gov agency confiscated my .gov agency's equipment.

Let me know how it is.   Just got back from a CEH class.  Not bad, but focused too much on tools and not enough on concepts.  Tools come and go, IT concepts stick around much longer than they probably should.

I thought the class was great.  It was mostly conceptual with small labs on packet capture and analysis, password cracking, and etc just to do it once and cement the concepts.  You come out of it with an idea of what things are and wanting more specific detail in the different areas each of which are one of more additional classes.  It was well worth the time.

[Ben]

Glad to hear you thought it was worth the time 41. My work is sending several of us to it for the first time to see if they want to make it a standard training class as part of meeting some new fed.gov security requirements. Did you go to the Bootcamp one that has the evening sessions? If so, how were they? Also, did you bring a clean laptop, or just whatever your regular work laptop is? I'm curious on if they ask you to do a lot of setting changes in the course of the class I would have to keep track of to "reset" mine before I plug it back into our AD. If so, I may want to grab a loaner.

I'll be sure to post a report for you guys when I get back from the class.

[41magsnub]

I imaged my laptop HD before the class and then did a fresh no patch/sp/fw/av XP load on it.  Then I threw office on it just to have it.  After the class I imaged it back to what it was before.  You get a CD at the beginning of the class that has all of the tools used on it.

People were looking for vulnerabilities on other folks machines all through the sessions so having a clean load with no sensitive stuff was nice, plus having a totally unpatched machine with no firewall or AV software made it more entertaining.

One other piece of advice would be to make sure whatever laptop you bring (especially the NIC) likes Knoppix linux since a lot of the class is run from a bootable CD.  I found out ahead of time the built in NIC in mine would not work and packed an ancient PCMCIA NIC for that portion of the class.

There were no evening sessions for mine, just 9-6 for a week.  I wish it would have gone longer each day since it was in Salt Lake City.

I'll check my books for the version, if they are still the same as what you use I can send you a searchable PDF I made of them which would make the test you take later at home a snap.

[Ben]

That would be awesome if you could send me the pdf! Thanks for the heads up on computers. That's making me lean towards taking a clean one for class (and an extra NIC).

[RevDisk]

I wonder how often that's happened.

TSA hires ex-cons. Likely some who are quite familiar with things like blackmail, extortion, industrial espionage. Supplement income with old habits and skills... See someone's laptop case has a business card for ABC Corp. "Need to confiscate it". Oops, it got lost in the system. Sold to XYZ Corp for a good sum for industrial secrets.

More often then one'd think.  Companies keep such things quiet for obvious reasons.  You don't even have to risk trying to sell it.  "Find it", threaten to eBay it, and watch the company shell out more money to get it back than a compeditor would pay for it.

"Rabid, with a touch of PCP" should dictate our NORMAL security posture.  Let alone international travel.  More difficult than an elegant defense in depth network infrastructure or fancy SAN isolation strategy is getting the brass to realize the little things matter.

[41magsnub]

Ben, PM sent looking for where to send the files.

[RadioFreeSeaLab]

VPN.  Check out http://hamachi.cc.

Also, I use Truecrypt's whole disk encryption.  Yes, I could be forced to give up my password, but Truecrypt has ways of dealing with that as well.  Hidden Truecrypt volumes, entire operating systems hidden and encrypted, etc.