Hacker News Reader

Comment by psybin | Hacker News Reader

> Encrypt them with spacefiller data and start crossing borders, and then refuse to provide passwords and abandon them for sheer amusement.

You don't get that option. The first thing that happens to everybody who is attempting to enter the US and flagged is that they give you a form to write down all keys and passwords you might have, they will then unlock your phone and attempt to find anything that might be used to bar you from entering.

A common method of confirming a profiled person seems to be using the "I have not done illegal drugs" checkbox on the entry documentation, they will find any drug reference on your devices using the passwords they just discovered. If you answer "yes", you're a criminal and you are barred from entry. If you answer "no" and they find any reference to any recreational drug, no matter the context, you just lied to a federal officer and you are barred from entry.

One rejection is enough to ban you for life from ESTA, so for most people entering the US who don't have a temporary working visa, being profiled is the last time you'll ever be able to enter the united states. A woman I was speaking to was bumped back onto their flight for a 3 year old SMS on her phone where a friend asked if she wanted to come over and smoke a joint.

View on HN

The recreational drug thing is not something new, in the late 1990's a profiled guy coming to speak at a convention (linux convention ?) got his laptop vacuum and lab analyzed, results got back that at some point this 7 years old laptop had been in a place where there was marijuana according to the trace amount found. The guy got sent back. He had stopped smoking marijuana 4 or 5 years earlier.

I will refuse giving keys to hdd/usb, pretending they are randomly empty. I will give it to the phone (and have nothing there).

This prohibits them from barring me from entering, and allow them only to seize the hdd/usb.

The advice I've heard is that if you're concerned about being compelled to release passwords or encyption keys you should cross borders with no personal/work data on your devices. This avoids any 'half-truths' that could still get you into trouble. Once you have safely crosed, download what you need from during your trip from your server (and consider using it as a VPN for all your internet browsing).

If the authorities take your device out of your sight, and you're sufficiently paranoid, then discard it and buy fresh hardware.

Buying fresh hardware does not protect from US authorities. Snowden showed that they can actually intercept new hardware to modify it for surveillance. It is better to buy used goods or from store instead of ordering online.

What if I overwrite the partition table with an empty one, say "I'm just carrying empty HDDs", then restore it later? If all the data is encrypted, it will just look random, even if they dump all of it, which is what I imagine a new HDD looks like.

I'm not quite sure what you're trying to accomplish - TSA agents are no more trained in computers than your average mall-cop and if they do decide to inspect your electronics, it's likely because you were flagged already when the ticket was purchased or you rubbed the agent the wrong way. What your drive looks like is probably irrelevant as the decision to copy isn't based on evidence or practicality it's based on an order from higher up or a whim, and then procedure is followed, which for electronics is to plug the drive in and do a copy of some sort.

I mean you can do whatever you want but only the encryption is going to do you any good for actual security. Even if you make it really convincing that the drives are empty, procedure is still going to make them plug it into the copier anyways. I mean, from the article, they're confiscating headphones and power cords - there's no rhyme or reason here except intimidation; the agents don't investigate - someone else does.

Do what you like, but it sounds like hassle you're adding to what is going to happen anyways.

I'm not quite sure what you're trying to accomplish - TSA agents are no more trained in computers than your average mall-cop and if they do decide to inspect your electronics

This depends entirely on the context. If you're a high-value target to an intelligence agency, there's a very high probability they would have someone pose as an agent of the TSA or CBP, or that they would have one of those agencies grant them access to your electronics. Someone involved in the publication of leaks or creation of security-related software would count as a high-value target.

they're confiscating headphones and power cords - there's no rhyme or reason here except intimidation

This, too depends on context. For the average person, the purpose is obviously nothing more than harassment. It's not difficult for a flash drive to be concealed inside a USB cable though, and if you're being targeted for a search, it makes sense for them to take everything.

On the other hand, a MicroSD card can be hidden just about anywhere, so if they're not going through all your stuff with a fine-toothed comb, the whole thing is theater.

> If you're a high-value target to an intelligence agency...

They have threatened to shoot a presidential plane flying over Europe and searched it on the possibility that Snowden might be on board. So yes be aware when you are a person of interest.

While I don't disagree on the possibility of a high value target getting preferential treatment, I'm still not sure why they'd waste the time besides having a slightly more competent agent plugging the stuff in to make sure it's copied. Or just confiscating the drives straight up as they did in the article and sending the target along. There really isn't a need for an on the spot forensic analysis, as the type of equipment you'd need would just be space prohibitive in an airport.

My objection to the commenter's idea was pretty much that they're going out of their way to create a scenario in which it looks like the drive doesn't contain data, but unless you are a high value target, all that work would likely go unnoticed since you're just getting a standard agent. Even if you didn't, and you had a recently graduated CS savant as the agent, it seems more likely that there would be no investigation to wonder "should I copy this drive or not" - they'd just do it. Or just confiscate the drive, etc. You can make the effort to try to make the drives look blank, but that feels a lot like theatre. It'll maybe fool someone looking to pull data, but if they just do some raw disk dump like with dd or most forensic tools, I don't think it makes much of a difference. It's just planning for a situation that really wouldn't happen.

>It's not difficult for a flash drive to be concealed inside a USB cable though, and if you're being targeted for a search, it makes sense for them to take everything. On the other hand, a MicroSD card can be hidden just about anywhere, so if they're not going through all your stuff with a fine-toothed comb, the whole thing is theater.

I'm not really sure on what the argument is here. Again, I think if a high priority target is really going through, they're not taking the microsd with them. There are far better ways of moving such data, such as a trusted 3rd party who receives the parcel through a series of proxies or a secure transmission, etc. If you are a high value target or in a dangerous profession or project that you feel warrants protection, there are a myriad of better ways of moving your sensitive data across checkpoints. If we wanted to get really fancy, you could have carrier pigeon or a falcon fly it across the border, or feed it to a dog and wait for the micro sd card to be pooped out.

I'm not saying that we shouldn't be wary and consider protections, but it just feels like this line of thinking in tech crowds tends to lead to incredibly specific scenarios that their solution resolves when many much more practical solutions exist. Under the auspices of fun mental exercise, I think it's fine, but when we're considering these as actual solutions to the very real threat of government searches at check points, then it's just adding bad suggestions.

> make them plug it into the copier anyways.

I heard USB is a finicky thing, rather hard to implement correctly.

I wonder how many of these copier devices (-- are these dedicated DSM-like units? Probably embedded/outdated Linux then!) were already infected and grep copied contents for relevant data.

1. "empty HDD" may or may not be regarded as suspicious

2. it may not just look random, unless the encryption is done in a way that tries to be plausibly deniable. Not all disk/data encryption methods try to hide their existence.

A new HDD is more probably full of 0s.

Which will be suspicious if the device is not "new in the box".

>This prohibits them from barring me from entering

In practice, you can be barred from entering the US for effectively any reason at all, unless you are a citizen. At the border you have almost no rights at all.

You say that, but put in the situation you'll find your bravado is significantly lessened.

Right. The best scheme requires no bravado. You should be able to tell the truth:

1) use FDE with a LUKS-like scheme where the encryption header can be backed up and then removed (making sure you can restore it at your destination somehow).

2) Destroy the header before travel. Carry live media if you need to use the machine while traveling but keep it minimally provisioned (nothing personal on there).

3) Your machine essentially now contains random data (even to you), perhaps except the partition table and/or boot parition(s). Tell the authorities that you "fill your hardisk up with random data before traveling in case of theft."

This is a true statement because: a) without the LUKS header your own data is essentially random, even to you and b) the scheme does protect your data in the event of theft.

Thus you can safely utter it with no bravado.

An even better scheme would use verified boot of some kind so that if the device is confiscated and returned, and its critical to you, you may have some way of proving the boot loader hasn't been tampered with. But I can't speak as to the difficulty of this.

It's just such a moot point.

If you have relevant data, then you simply don't cross borders with a device containing such data (or with a computer at all). This is just common sense. This "plausible deniable encryption at the border" nonsense is just a cryptonerds imagination.

This sounds cool when you are the one doing all the talking, but when the border agent asks a simple question such as,

Do you have personal data on this device?

and you answer No (when you really do), then you're looking at 5 years in prison under §1001(a)(2). https://en.wikipedia.org/wiki/Making_false_statements

You'd have to give them a reason to arrest and charge you first.

You are at the US border asking for entry, unless you're a US citizen you basically have no rights and gave them a reason to arrest you.

They don't just arrest everybody with no rights.

What if it's empty?

Then you can answer in a way that doesn't violate §1001(a). Honestly though, I don't think the scheme is smart in the first place because it can put you in trouble if authorities question you.

A much better method I have heard is to ship your electronics beforehand, travel with only a burner cellphone, then pick up the electronics after you arrive. Repeat when traveling out of the country.

But then you have a huge problem if the shipment is damaged or delayed. I think the best way is to upload encrypted data somewhere and retrieve it after entering the country.

I think this is probably correct. But I would be sure to encrypt my device before mailing it too.

> Tell the authorities that you "fill your hardisk up with random data before traveling in case of theft."

Better yet, tell them your laptop broke while in the airport before boarding the plane, and you are going to buy a new harddisk/get it serviced when you arrive at your final destination. Much more plausible.

> tell them your laptop broke while in the airport before boarding the plane, and you are going to buy a new harddisk/get it serviced when you arrive at your final destination

It's a felony to make false or deliberately misleading statements to U.S. border agents. Unless your laptop actually broke while in the airport, performing the scheme you described is a felony.

And as in the original "scheme" -- this is a question of technicalities and (perhaps only if you're a US citizen, perhaps not), whether or not the authorities in question are willing to take it to trial and prove that you "lied".

If you removed a key header which is crucial to the operation of your device in the airport, then the question is whether you can legally say, "my laptop broke in the airport," even if it was you who deliberately broke it.

This also covers the case of the question, "Does this device contain personal data?" To which you can truthfully answer, "Yes."

The point, in my original scenario also is not to lie, but to simply avoid being able to provide access under duress.

Sure, just as the scheme described in the post I was replying to. In both cases it's assumed that the lie is undetectable, by virtue of properly encrypted data being indistinguishable from random noise, and of the scheme not being shared with anyone else nor written down.

...and how would they prove that, or even suspect it in the first place?

Still you aren't telling the truth when you say that you filled the harddisk with random data. Without headers the data is random, but you have a backup. Where do you keep that? Is it somewhere in the cloud where you can download it to restore it when in the US? If they really don't trust it, and keep you for several days (I don't know if this is possible without other offenses), at what point will you break and tell just to get away? How strong are you when you're there all alone and haven't really done anything?

Why not whipe the disk and enter with a clean system if it's so critical?

I agree - basically. The scheme is designed to be a half truth essentially. One that you can mentally convince yourself of in a tight situation, which would relieve you somewhat of the need to be "tough", psychologically speaking. At least for a while, anyway.

wrt giving up the key under extended duress, I was thinking the same thing and aside from simply wiping the disk I can think of another scheme that might serve you well: give the header to a trusted 3rd party who could simply be the one actually controlling access to your data. Your lawyer for example.

If you give it to your lawyer, it's still half truth, and still you can break and call him to mail the headers to you. If this is so important, setup a server that you control with your data encrypted on it, and enter the US with a clean Ubuntu system, or even a Chromebook with a fresh account.

>3) Your machine essentially now contains random data (even to you), perhaps except the partition table and/or boot parition(s). Tell the authorities that you "fill your hardisk up with random data before traveling in case of theft."

Sounds like a sure-fire way to get them to harass you more and pay closer attention to yourself.

Yeah perhaps this is not the best hypothetical response...

I still believe there is a way to adjust such an encryption scheme to meet the ideal criteria:

1. you're not lying 2. you can't provide access 3. you're not drawing extra attention to yourself

If this is what happens, then this is not a free country. There is a border where you must stop in harassing your own citizens under the pretext of security.

Few countries (if any) are really free.

> Tell the authorities that you "fill your hardisk up with random data before traveling in case of theft."

And you just made yourself a suspicious person to be further questioned and searched, while probably committed an offense that could send you to jail.

But again - the point is not to lie, technically and thus avoid commiting an actual offense. If your data is important enough to you, you probably will want to consult your lawyer before attempting such a scheme :)

No, they can bar you from entry for any non-compliance.

> using the "I have not done illegal drugs" checkbox on the entry documentation

What? I have lived and worked all over the world, travel regularly to a bunch of countries, and have never once seen this. I could have missed it on some less frequent countries, but certainly it's not on any major country's entry card.

https://i.imgur.com/BMuAufo.jpg

"Have you ever violated any law related to possessing, using or distributing illegal drugs?"

"Do you have a physical or mental disorder; or are you a drug abuser"

It's also on the customs forms for New Zealand, where you're asked along with questions about any drug paraphernalia you might be bringing in. They seem to be much more concerned about fruit than people slipping through with a bong though. Only country I've ever been set upon by fruit sniffing dogs.

I've been pulled up by the kiwi's their basic problem was me not doing drugs in their country. Similar approach was used on my buddy "I'm glad you answered yes to pot, because if you'd declined I wouldn't have believed you and pulled you in anyway".

So we were all pulled in an at that point I figured there was no reason to lie. I discussed all the drugs I'd done previously and they stated there was no way for them to prove I was (or was not) smuggling as trace amounts were found in the bag I admitted to carrying them in for previous ski trips.

I stated it was illegal in my country but had no plans to do it in theirs. I was allowed in on the condition I didn't do illegal drugs in NZ... I accepted their terms and didn't do any gear while I was there.

I was once taken into a room and questioned by US border personnel for eating a banana after passing US pre-clearance at Dublin airport.

Technically still on Irish soil but within the US customs zone, apparently, and I had thus lied on my form when I said I wasn't tranporting fruit or vegetables into the USA.

Practically you were on Irish soil. Technically you were in a foreign trade zone of the United States :P

I flew into Chicago from the UK a few months ago. A guy a few spaces behind me in the line had a search dog stop at his feet. He had some fruit in his bag. I can't remember what it was, an apple or something. They gave him a form to fill in and he had to pay a fine.

I had a banana in my bag. A very ripe one. But the bag was on my shoulder rather than on the floor by my feet so the dog just walked straight past me. There's a hack to remember.

If anyone's thinking about it - don't. mike-cardwell got lucky. Dogs at the airport sniff everything. Whether you have something in your backpack or the bag on the floor, NZ has pretty bad fines even for stupid stuff like obviously half eaten and taken by accident piece of fruit.

Yeah. I certainly wouldn't recommend doing it on purpose.

> But the bag was on my shoulder rather than on the floor by my feet so the dog just walked straight past me. There's a hack to remember.

I've been asked to take my bag off my shoulder so the dog could sniff it. I wouldn't recommend this 'hack' — seems too likely to fail.

I'm surprised any bag would ever be allowed anywhere off the ground in their presence. K-9 officers generally just call for all people to rest their bags and luggage on the floor to one side. While the dog makes it's rounds, you're also being watched for body language and behaviour.

Or... Just buy a banana from the fruit shop on the other side of the border, and don't risk a fine or ruining a country's entire fruit industry?

"ruining a country's entire fruit industry?" is overly dramatic. If this experience was anything to go by, it seems likely that fruit is constantly accidentally brought across the border. I've been to the US a few times and this is the first time a dog went anywhere near my bag, and even when one did, it didn't detect the fruit.

That'd be because, like Australia, there's a very isolated ecosystem there that could be decimated by unintentionally bringing in diseased fruit from overseas. Australia has similarly strict rules on bringing food items, etc. in because it has a similarly isolated ecosystem where some diseases prevalent elsewhere simply aren't found here, so the ecosystem isn't resistant to it.

Do not go to Australia with dirt or soil on your shoes.

Serious question: I live in Sweden and have officially diagnosed autism/adhd, so I would have to answer yes to the first question. What are the chances that I will be denied entry purely based on that answer?

Same here, there is an expanded documentation page describing this exact question (and a few others): https://esta.cbp.dhs.gov/esta/WebHelp/ESTA_Screen-Level_Onli...

Quote: ```(b) You had a physical or mental disorder and a history of behavior associated with the disorder that has posed a threat to your property, safety or welfare or that of others and the behavior is likely to recur or lead to other harmful behavior. Answer "No" if: (a) You currently have no physical or mental disorders; or (b) You have or had a physical or mental disorder without associated behavior that may pose or has posed a threat to your property, safety or welfare of that of others; or (c) You currently have a physical or mental disorder with associated behavior, but that behavior has not posed, does not currently pose nor will pose a threat to your property, safety or welfare or that of others; or (d) You had a physical or mental disorder with associated behavior that posed a threat to your property, safety or welfare or that of others, but that behavior is unlikely to recur. ```

Excuse me, but what world do you live in that autism/adhd is a "disorder"?

"Attention Deficit Hyperactivity Disorder"

We're pretty serious about our biosecurity here in NZ.

Nope. I've seen someone caught by a fruit (and presumably other substances, too) sniffer dog on entry to the US via Atlanta. So not just NZ...

They have the fruit sniffing dogs in the US. I've seen someone in the immigration line at O'Hare get pulled aside because they were smuggling in an apple from the flight. (No doubt there were several in the trash on the plane, which is likely emptied into the US.)

I've never seen this at JFK or LAX though.

I would imagine that such a question is standard all over the place. Almost like a canary trap? For example, life-insurance forms. They ask you those types of questions as well as questions along the lines of "have you every been denied life-insurance by any provider for any reason".

I'm pretty sure that the customs form for NZ doesn't ask anything about drugs or drug paraphernalia.

On the note of that form you linked, apparently they send the results live, a friend of mine for a joke checked "yes" to Question 3, and now her visa application is under review.

What form is that? It certainly isn't a landing card. Maybe a visa application, but the number of western country with visa free or visa on arrival is huge.

It sure says a lot that a mental condition is grouped with drug abuse and carrying a sexually transmitted disease.

  You don't get that option. The 
  first thing that happens to everybody 
  who is attempting to enter the US and 
  flagged is that they give you a form 
  to write down all keys and passwords 
  you might have, they will then unlock 
  your phone and attempt to find anything...

Actually, I have all the time in the world before my next flight, so I do get that option.

You see, even if I'm forced to write down a password, if that password decrypts a 3TB file filled with shit data that LOOKS like it's still encrypted somehow, and then throws errors on further attempts to decrypt, the goal is achieved.

I have old laptops I'm ready to throw in the garbage. I have old, dying hard drives I can partition with nonsense. If that's all I'm carrying, then border patrol can merrily spin their wheels on it, and it will never contain anything valuable, despite appearances, because it is junk and contains junk by design.

For phones? Well, if all I'm carrying is a 1990's candybar phone with a 4 digit pin, and I "unlock" it for someone, and it shows "NO SERVICE" because I never paid money to activate service on that phone, even though it's the only phone I'm carrying, the goal is achieved.

If I'm carrying a trashy 2008 edition smartphone, and I unlock the bootloader, and reflash with a custom ROM that contains 500 garbage contacts with (555) 555-5555 numbers and John Doe as the name, and then encrypt an SD card with a FAT partition that contains a single 4BG encrypted file that's really just random data, or maybe 9000 files with misleading file names, but all contain junk when decrypted, the goal is achieved.

If I jail break an old iPhone C that I bought refurbished, second-hand for $50 and then I activate it's password protection as the number 1234, but never place a SIM card in the slot, and load it with thounsands of random images from the internet, and tons of fake notes that look like Base64 data, and that's the only phone I'm carrying, the goal is achieved.

Your tangent about drugs is an unrelated digression.

Staging junk devices with garbage data, for the purpose of sacrifice to security theater, is fun, easy, and anyone can do it if they've got the next week or two to pack their bags.

You do realize you're wasting your time as well. It's not like you're allowed to get a coffee from Starbucks and visit the brothel while the agents search your things.

For some people, their time seems to be already wasted, no matter their actions.

No need to waste their expensive devices AND their time.

Retrieving confiscated devices can ruin time as well.

A device you can safely discard, in lieu of bureacratic form signing, waiting-in-line retrieval queues, is also time saved. Now they've confiscated what amounts to used toilet paper.

Did you read TFA?

Choosing to bring devices full of encrypted noise vs choosing not to being devices is deliberately choosing to waste your time in addition to the CBP officers'. Maybe that's your goal, but they get paid to do that so you aren't exactly teaching them a lesson. If anything, you are just being rude to other people who want to cross the border since you've impacted the throughput.

It's sort of like "teaching the cops a lesson" by loitering around the local school in an ice cream truck implying something might happen.

Well, gee whiz. Don't I feel terrible now.

Like, wow man. It really makes you think.

It makes me think about illegal search and seizure, and how I guess that only matters for special people. It makes me think that, hey, maybe some inalienable rights are actually kind of alienable, depending on who you decide to alienate, right?

They get paid money to do their jobs. Well wowee! That means they're correct in fucking people up arbitrarily right?

Special person on a blacklist? Fuck 'em up! Don't like the looks of those guys? Fuck 'em up! Hate your job and need to take it out on somebody? Fuck 'em up!

Sure, I get that. But where does the black list come from? Can I vote on who gets listed?

You know, I got some people I'd like to fuck up, myself. Would that be okay?

What if I decide to hire someone to fuck someone else up for me? I got some money to pay them. At that point, they'd be doing their job.

Hmmm. Maybe I should pick a career that let's me fuck people up, just so's I can help write those lists. It'd be my job, after all.

Let's just humor the idea that, if they've got a job to do, they're obedient about it. Let's say, in this instance, the person harassed really is a piece of shit on a list for a good reason. Let's say that leaning on this guy and sending him a message was a good idea, for reasons I can never know about, but trust in that.

Okay, fine. He was the right bad guy to knock down a peg, so send a message. Sent him a message and he got it. Mission accomplished.

The point still remains: hobbling technical carry-ons like the laptop he has, and cloning handhelds to scrape for metadata intel is still a pathetic strategy which would only slow down a half-retarded script kiddie. It's a weak tactic that isn't going to offer real protection at any border, because that's not how smart people with technical skills approach a border.

If that's anyone's idea for how to interdict hacker operations and learn the details of their network, guess what. Consumer grade computers are likely a mere distraction in this scenario, and it's unlikely that a border agent is going to notice a device or technical object intended to survive a border search.

It's not likely that grabbing these sorts of devices stops the people that care about getting certain devices and data across.

Maybe raising the bar and taking ordinary laptops and handhelds off the table to advertise that it's not childsplay to bring general technology across a border might be another message to send non-professional trouble makers and problem children, such as in this case. Either way, to be honest, I think border patrol is out of their element and beyond their depth in this sphere.

Being a hammer, and approaching all border stops as nails, is a strategy for a century ago, when a pipe with a handle was surely a musket.

What if you don't hand over the password?

You apparently lose your phone, and you can be sure they will copy any content on it, even if it's decrypted. If you enter, change your PIN to something alphanumeric, especially when you're on Android. Just a number is easy to beat, even if it's 10 digits long. I think the latest iphones are safe enough. I don't know about Windows Phone, but don't think it's safer than Android.

> I think the latest iphones are safe enough.

Not sure about that. After Apple refused to help, the FBI claims to have hacked that iPhone anyway, with a tool developed outside the government.

https://www.theguardian.com/technology/2016/apr/27/fbi-apple...

It was an iPhone 5c. No Secure Enclave.

BTW, what was the result of that? They paid hackers a ton of money to unlock old firmware, iOS 8.0, on an old phone, 5C.

Yeah, but that's an iPhone 5C, which is three generations old.

This was also a phone from a terrorist.

> This was also a phone from a terrorist.

I think the downvoted parent is relevant in that they mightn't make the effort for a 'normal' person.

> I don't know about Windows Phone, but don't think it's safer than Android.

Windows Phone user here. I know for a fact the SD card you put in your phone is encrypted and can only be decrypted in the phone itself[1]. I don't know for sure about the internal storage; it's supposed to be encrypted if you use a screen lock on your device but I have no easy way to test that. Regardless, if they can force you to reveal your pin/password you're hosed anyway.

[1] "Can't be decrypted" assumes, of course, that the government wanting to decrypt it doesn't have an agreement with Microsoft to hand over the private key or otherwise provide access. My understanding is that Microsoft's position lately has been "no warrant, no access" but that could just be lip service. In either case, Windows Phone is a dying platform and anyone security conscious enough to worry about border crossings would hopefully have something more inherently secure anyway.

Windows Phones use the Secure part of the Secure Digital(SD) standard. Very few other platforms use it.

That's my understanding, yes. And I've had to deal with it first hand when I forgot I had used a certain SD card in a Windows phone and then tried to access its data in another device. I had to pull that old phone out of storage to access, then wipe and unlock the card. It's a great feature that I wish other phone manufacturers would adopt.

Windows Phone/Mobile user here. SD card content is not encrypted. Encryption for SD cards is coming in the Windows 10 Creators Update and just dropped in the dev builds[1].

[1] https://blogs.windows.com/windowsexperience/2017/01/12/annou...

It's been a feature since the WP7 days, and as I stated in another comment, it's obviously still in practice because I've had to decrypt a card using the Windows Phone 8.1 (upgraded to 10) device that originally encrypted it.

http://www.ghacks.net/2010/11/13/windows-phone-locks-in-micr...

http://www.card-data-recovery.com/unlock-windows-phone-7-car...

Maybe this was an WP7 feature which still had backwards compatibility.

My personal knowledge starts with 8.1. At least since 8.1 - so practically any relevant phone sold or in use today - the SD card has a hidden encrypted partition which holds apps moved to the card and a public partition for user data (photos, downloads, audio, video etc). This public partition with userdata is not encrypted and can be read at any device.

In the coming W10M update it's possible to encrypt the whole card again, so e.g. photos are protected.

You know what...the same card has migrated with me from WP7 to 8.0 to that 8.0 device being upgraded to 8.1 then 10. Still, I had to put it back in that last device to get it unlocked for use on my current phone (Lumia 650). Otherwise the phone refused to recognize it, wanting to immediately format it, and ditto my Windows 10 and Linux desktops. On Linux at least, it did show two separate encrypted partitions, so given what you said that makes sense.

There's a device for unlocking I-phones. I saw it in action a few times at work: The I-phone is placed horizontally into a cradle, 40 cm above the screen there's some kind of a device. That device produces flash flights, a couple times per second and I suspect it takes pictures. If I remember correctly there's nothing touching the buttons. The officer said that it can crack I-phone 6 (7 was not out when I asked it). What I suspect is that it uses brute force and avoids the delaying system. Since I work in a low tech environment, I was surprised to see that thing in action.

What does a ban from ESTA actually mean?

I know that one can be ineligible for an ESTA. For example, if you've made a trip to Iran. However even if ineligible for an ESTA, a person can still go to a US embassy and apply for a regular visa, just like folks in non-ESTA countries.

It means, at the very minimum, a massive pain in the ass. Quite likely you will have significant difficulty gaining a visa.

OK. Seems the salient point is that once you've been denied entry once, returning in future becomes more challenging.

That'll be the case regardless of whether you've been eligible for ESTAs or had to obtain visas via embassies in the past.

The "banned from ESTA" phrasing had me scratching my head.

What if I make sure my phone has 0% battery when crossing the border?

Will they wait for it to charge, and THEN inspect it anyway? Or do they let you through.

My impression is that, in the US, you must be able to turn on electronics, or you will not get the chance to charge them, they will be disposed of.

As always with these things, the answer probably is going to be "depends".

also, what kind of phone can't be immediately powered up when connected to a charger?

> also, what kind of phone can't be immediately powered up when connected to a charger?

If sufficiently discharged, an iPhone requires about ten to fifteen minutes on a charger to power on. This is true of all models, going back to the original release.

My question is really aimed at "will they bother to plug it in and wait", or would they just skip it.

My android [Acer E380] sometimes can't start without a few minutes on the charger, the battery is dying after the designed in service period.

Moto G2, takes about five minutes to go from 0% to 1% and does not turn on until then.

iPhone, takes a few minutes to power it once it's dead.

My iPhone (5S) can't.

They will probably make you throw it away. I temporarily lost the battery to my euro mobile. I got an SSSS on my boarding pass and they made me show all of the electronics working. Luckily I found the battery and it had a charge on it.

Or if you have a removable battery (like OP did) just leave the battery at home and buy a new one when you land.

Reply on news.ycombinator.com