Stop Fabricating Travel Security Advice | Hacker News Reader

Stop Fabricating Travel Security Advice

medium.com

120 pointsimartin2k87 comments

>If the officer demands that you turn on your device but the battery is dead then it mean that you are unable to comply. Ah ha! A clever loophole that no one has ever thought of before.

Yeah....about that:

http://www.etihad.com/en-us/before-you-fly/us-preclearance/

All guests travelling to the US, UK or Canada from Abu Dhabi International Airport are required to turn on all electronic devices in their possession prior to boarding. Guests must ensure that all electronic devices in their hand luggage or on their person, including mobile phones, tablets and laptops, are charged to minimize any potential disruption to their journey.

Abu Dhabi Airport does not have a facility to store devices, which cannot be powered up and Etihad Airways cannot take responsibility for devices which are left behind.

This requirement is part of enhanced security measures by the authorities of these countries. Failure to do so may result in not being allowed to take the device(s) onto the aircraft or being denied access to fly.

I seem to recall a story from several years back about bombs being disguised as laptops. Requiring devices to be powered on was a simple strategy to make sure they weren't completely fake.

[1] https://www.google.com/amp/s/amp.cnn.com/cnn/2016/02/11/afri...

[2] https://www.fedscoop.com/tsa-targets-explosives-disguised-tr...

I wouldn't be surprised if all electronics had to be powered on for that reason. (Snooping aside.)

> Good travel advice to follow in a later post…

Do not travel to the US until they treat non-citizens as people.

Good grief -- do you know how many non-citizens easily enter the US every day? Thousands. The vast majority have zero issues at all. The reason that these occasional issues even make the news is because it's outside the ordinary; the media cherry picks some sympathetic character, "He's a respected Holocaust historian!" and they turn it into a representative data point that the immigration enforcement system is off the rails. Combining that with an anti-Trump narrative, they get more page views and another news cycle to lament the failure of US policy.

75 MILLION non-citizens visit the United States each year and 41% of those entered via New York, Miami or Los Angeles.

On a typical day, less than 1000 people are refused entry. Some of the reasons for refused entry include not having sufficient funds to support themselves for the duration of the trip, suspicion of being an intended immigrant without a visa for that purpose, ties to criminal organizations, having overstated a previous visa, having a dangerous infectious disease, having been found guilty of crimes of moral turpitude (rape, fraud, child mokestation,) having been found guilty of a major crime, a lack of proof (in the case of tourists) of continuing ties to their origin country.

This hyperbole about non-citizens not being treated as people is just nonsense.

In Schengen (and many other countries, such as Korea), you can get randomly stopped for visa and passport checks, especially in Germany, Austria and Switzerland. If you overstay a Schengen visa for even a few days, you can sometimes expect to endure a more inconvinient immigration experience when attempting to leave the area (especially in Germany.) You have U.K. immigration working on Eurostars leaving from Brussels South and also allows them to actually work in the station. You have Belgium-UK information sharing and coordination on that route.

There have been instances of U.K. Immigration denying entry to an American woman carrying a cello because she was to play in a free concert at a university in Leeds. They deemed that unpaid activity "work," detained her for 8 hours and deported her back to Chicago. Other academic performers have been denied entry when carrying large instruments as well.

My point: immigration everywhere has seemingly arbitrary, ridiculous incidents. Should we just stop traveling anywhere?

> not having sufficient funds to support themselves for the duration of the trip

How do they know? Do they check/request bank account details at the airport?

Sometimes yes. Same happens for Australia for example (you may be asked for a bank statement with your visa application)

Yep. Wish I could find a link, but there's one episode of Border Security: Australia's Front Line, where a tourist / backpacker is asked to demonstrate proof of sufficient funds to enter the country. He's escorted by Border Security to an ATM, where they ask him to access his account and display the account balance on screen for them to verify. He didn't have to comply, but if he didn't do so they intended to deport him back to his home country, at which point he would have been subject to a 3 year exclusion period from visiting Australia again.

"a lack of proof (in the case of tourists) of continuing ties to their origin country."

As a US citizen who has traveled to nearly 60 nations, I have never met a more accusatory, aggressive, macho, angry, often-times rude reception than in my land of birth, and I'm a native-born citizen!

While what you say, regarding Schengen border controls, may be somewhat true, the nature of their "extra procedures" is completely different in quality to the American counterpart. One doesn't find the systematic large-scale militarized detention center processes nor attitudes. We are the most aggressively suspicious nation and yet no one seems to question 1) if it's even effective. Barring warrant nabs, which a simple ID scan can produce, what actual harm to the public is being prevented and at what cost to our national values and business productivity? (to say nothing of the MOOD)

2) if, in fact, foreigners are actually coming over to the USA with the explicit intent to harm the nation and how you could possibly stop that at a border, if they were to comply proceduraly. I would warrant that most people will be hostile to hostile and intrusive questions asked by an irate and overworked angry border beaurocrat whose only daily joy, as pointed out in the article, is in exercising their power to expel someone etc...

3) What about Ben Franklin's famous quote and our national values? "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."

I think that it's clear as the nose on my face that recent top-level directives and a general change in leadership and policies has resulted in a more rigorous entry process to the USA and the work culture for these officers has changed from "be polite cheerful and thorough" to "give em a hard time"

If we can get some acknowledgment of this point, that would be great :D Why such a sycophantic attitude towards those abusing power?

The proper attitude depends on the situation - the place and time to not be sycophantic towards those abusing power is e.g. at the ballot box, but not when giving travel advice to a foreigner - who can't change the system but have to work with it to do what they want.

> As a US citizen who has traveled to nearly 60 nations, I have never met a more accusatory, aggressive, macho, angry, often-times rude reception than in my land of birth, and I'm a native-born citizen!

I don't disagree with your other sentiment but this part made me laugh. My anecdotal experience has been that it varies considerably depending upon the staff member but generally they are as bored as immigration at every foreign port I've entered (Sample size of 40+ US entries as a permanent resident at LAX, ORD, ATL, SFO, IAH, and several land border checkpoints with Canada. Foreign experience has been NZ, Australia, Hong Kong, Vietnam, Malaysia, UK, Spain, France, Denmark, and Germany - all major entry points) and never had issues with US immigration, including one time when a green card expired while I was out of the country.

I've been grilled more aggressively by UK and Danish immigration! I always assumed that this was just part of their training to catch people looking to overstay though.

We have a mix of US and New Zealand passports and I've always put the NZ one on top - the agent usually starts admiring the design as I hand it over and the conversation starts on a friendlier note!

> a lack of proof (in the case of tourists) of continuing ties to their origin country.

As a digital nomad this is what worries me when I go to the US. I would never want to live in the US but try convincing a border guard...

I'm alway extremely nervous when encountering an immigration officer in the US because they are much more aggressive than the ones I've encountered in other countries (and I've traveled all over Europe and Asia).

You've never encountered an immigration officer in Asia that flat demanded a bribe? Cause I have.

In China I was required to register with the authorities every time I switched hotels.

I've had interactions with Canadian border agents that was very unpleasant and seen German border agents armed with submachine guns take people off of trains.

Now, I think we (the US) should change the way our border officers behave & I think demanding access to electronic devices is dumb & harmful, but border patrol everywhere are agents of the state and can be scary to interact with.

For the record I've also had great interactions with Chinese, Canadian, German & American border agents.

I've had to pay a bribe in Southeast Asia but the officers were friendly and nice about it and it's expected. Likewise, I lived for 4 years in China and needed to register at the police station whenever I came back in the country but it's easy and it's not a huge issue.

I know what to expect in those countries and I know that there won't be any issues so long as follow the official or unofficial (in the case of southeast China) rules.

In the US, I don't like the arbitrariness of the border agents , I'm never sure if I might have an issue or not (like the article about the French academic). And, while not all US border agents are agressive, the most agressive agents I've met were all in the US.

I also don't understand why people complain and still go to the US. I'd never ever go to a country, which is that intrusive to my privacy.

In my company, people have a choice where they're sent, so if you like being stripped naked by the border monkeys, go but don't complain later.

Do not travel to the US until they treat non-citizens as people.

The US isn't the only country that does this.[1] Maybe instead of avoiding the US, don't leave your home country at all?

[1]http://globalnews.ca/news/3268531/cellphone-search-at-the-bo...

This is the thing that gets lost in some of these discussions. US citizens tend to shrug at this stuff and say, "Well, I'm a citizen, it doesn't affect me." But it WILL affect you, because once the US starts putting this stuff in place, everyone else will too. Intrusive border searches, electronic snooping and information gathering, insistence on decrypting devices and permitting searches of social media accounts, gathering biometric data...all these things that the US is busy imposing on immigrants and visitors, other countries will in turn happily impose on US citizens entering /their/ borders.

I remember back in 2004 or so, going to Brazil. At the airport in Fortaleza I saw a couple of Americans lined up to have their fingerprints taken as a reciprocity measure after the US required it of Brazilian citizens entering the US.

The prints were taken in the old-school way using ink and file cards - after which the cards were unceremoniously dumped in a bin.

Apparently, it is possible to be a d--k with some class when working border patrol duty. :-)

>>People who don’t own laptops, tablets and/or smartphones yet travel internationally don’t exist anymore.

Let me introduce you to my mother.

No, she's not 80 either, mid 60s. Total technophobe. Owns a PC and infrequently sends me emails IN ALL CAPS WITH NO PUNCTUATION. Someone gave her a dumbphone this year, she hates it and has put it in a drawer.

She loves her international travel though.

I travel with no laptop or cellphone as well. That part of the article was really bizarre.

> Do not lie to federal officers. Do not attract attention.

Aren't those in conflict? If you want to not attract attention you want to lie an appropriate amount, like everyone else does. No more, no less.

For instance, pretending you respect the security personnel and don't mind obeying their idiotic rules.

Some of the responses given to other rules don't seem...responsive. For instance, somebody who travels with a freshly-reset phone to restore later certainly might get extra vetting as a result...but SO WHAT? Going through a secondary screening is MUCH BETTER than having to give up your actual data. Isn't it? Given a choice between NOT letting them get your data and LETTING them get it, in most cases NOT letting them have it seems FAR safer, for the exact same reasons that it's a bad idea to let the police search your home without a warrant. You don't know what they plan to DO with your data access, so you might want to prepare for the worst.

The article is about foreigners. It's not just a choice between letting them get your data and not letting them get it. Not letting them could also mean being you turned away and never reliably be able to enter the US for the rest of your life. For most people, that's probably worse than having your device and Facebook accessed.

> For instance, somebody who travels with a freshly-reset phone to restore later certainly might get extra vetting as a result...but SO WHAT? Going through a secondary screening is MUCH BETTER than having to give up your actual data. Isn't it?

That really depends on how resistant a factory reset is to forensic techniques, yes? If they can recover 40% of the data, but give it extra scrutiny, are you really safer than if they have 100% of the data but look at it cursorily?

A lot of the bad travel advice I've seen reminds me of legal conspiracy theories in general: there is an underlying belief in the existence of magical incantations or ingenious solutions that will stop law enforcement agents in their tracks.

Reminds me the use of "SWIM" (someone who isn't me) on drug-related message boards to avoid self-incrimination.

While some of these 'legal conspiracy theories' are undoubtedly ridiculous (e.g. the people who think invoking 'sovereign citizen' will make an iota of difference).

But I have some sympathy for these beliefs - there's sometimes good advice (sometimes you need a lawyer before talking to the police) that might seem like a conspiracy or hoops you need to jump through. Hearing some legal arguments seems like semantics to the uninformed. This is probably why people think the legal system is 'magic'.

You know, this all sounds right, but so did the alleged "bad" advice at first.

There's a lot of uncertainty about this topic right now, and the author fails to point to any examples or experiences from real-actual-travels to verify any of the advice being given here, rendering the article as baseless as the kinds of advice it's attempting to call out.

In truth, I believe he should take a cue from his own headline.

I travel without cellphones and tablets all the time. Last time I went to Spain, I bought a prepaid phone while I was there.

The Grugq is more credible than most social media randoms, although I grant that it's hard to know that if you aren't aware of his bona fides.

I'm sure that's true. But it doesn't change my core argument: Every time we write something that reaches a wider audience (social-media-randoms and pseudo-randoms alike), we have an opportunity to stress to the reader that they should check these facts for themselves - either by pointing to data and examples (which my original comment accused our friend grugq of failing to do), or by simply stating to readers that they should be wary of bad travel advice and look into it.

Now that I flesh out my argument, I realise I'm scapegoating this article a bit, and my real lament is that there AREN'T enough accounts and examples of what to do in these awkward border situations. The only commentary I've seen from legal professionals is that there "hasn't been a case" yet, which would flesh out the meaning of the types of demands border agents are allowed to make.

It's a pretty tricky problem. Democracies are good at improving things inside their borders, but that stops -at- the border, and the current situation is the proof. I'm at a loss for now as to how it's going to improve.

> "Carrying no devices ... interrogated for hours."

Right. So citizens who are aware that the CBP can now peer into their personal affairs decide to leave their devices at home as a matter of privacy and principal. Therefore, this makes these citizens suspicious enough to be interrogated for hours, because:

> People who don’t own laptops, tablets and/or smartphones yet travel internationally don’t exist anymore.

Give me a break.

> Because it is normal for people to travel with blank devices, in no way will the CBP officer suspect that you have something to hide.

It is common for businesses to issue employees blank laptops specifically for international travel.

Is there a "best practice" doc or description about that somewhere?

    > It is common

Cite?

At one time is was common at Facebook to give employees traveling to certain countries burner laptops and given recent US policies I expect more companies to enact such policies.

Not a citation but I've heard of various UK companies that do this. Usually for intellectual property reasons.

Blank as in "wiped" or blank as in "wiped, reinstalled OS and apps, configured for the user but with no corporate data on the device"?

My employer (Big engineering multinational with a finger in lots of pies, including aerospace and defense) issues travel laptops and phones if you go to any number of countries, including the US.

Fresh OS install, required additional software, VPN client, 2FA for connection, one factor is given to you by a local company rep after you have cleared immigration. No company info whatsoever on the laptop as you depart - not even your itinerary.

Instructions are to wipe the user partition (using some proprietary, presumably good disk wiper) before heading for the airport again - and not leave ANY information on that partition unless VPN is unavailable, anyway. Also, do not leave the laptop unattended or on a network unless necessary.

When returning to HQ, drives are said to be removed and zapped before a new HDD is installed and the laptop is ready for the next user.

The plural of anecdote is not data, but based on what I've heard from others I've worked with, this is now close to standard practice.

> People who don’t own laptops, tablets and/or smartphones yet travel internationally don’t exist anymore.

Why would I take my electronics on a leisure trip? Isn't it enough to depend on them during work hours? Does this really rouse suspicion at CBP?

I don't know why this is downvoted. This is standard practice by many people who travel, especially if traveling with the whole family.

They go to a foreign country voluntarily with no comms devices whatsoever?

I didn't the last time I went on vacation in Europe. My cell phone carrier also is atrocious and charges usurious international roaming charges, so that was a contributing factor, but it's really nice to unplug and go off the grid on vacation. You just have to do things the old fashioned way - print out your reservations and itinerary, get some maps.

I enjoy that, but it's nice to have GPS for emergencies.

> My cell phone carrier also is atrocious and charges usurious international roaming charges

I sometimes get temporary SIM's when abroad, for this reason.

Sure. Everybody did for all of history until about twenty years ago. Many still do. It's really not that crazy.

20? I recall going to Europe for two weeks in 2006 (BMW European Delivery). Didn't bother bringing my dumb-phone. Just had a camera. I drove 2000 miles around Western Europe, 6 countries, had zero hotel reservations before I left, and had no problems whatsoever. This was in April so just popping into a hotel and finding a vacancy was not a problem.

Add I don't know why this is down-voted either.

When I go on holiday, I don't want business calls and emails following me. If I need to make a call, I'm sure I'll find a way to make it.

You don't need to have your work communication on your private phone. If you want to do that, you can still temporarily disconnect them before leaving for holidays...

That statement makes a few assumptions. I don't have more than one device for this stuff. My business and clients all emergency numbers (which would include that person number if it existed). I also have a painfully small amount of self control and have in the past nipped off to check my emails for "10 minutes".

A holiday can be a good opportunity to disconnect completely.

Maps, emergency communication, personal communication, photos, information lookup, and many other reasons. I'm not saying you need it, but these are reasons you'd take it for convenient traveling.

You can always compartmentalize and not connect your work accounts to your private phone. It's not crazy not to have a phone with you, but it's definitely a statistical anomaly.

Because, roaming agreement with Europe can be so expensive and your phone so old (thus not supporting the dual band) you prefer to buy a cheap local one?

Once again thrifty persons are common, and modest people can prefer to travel once a year for the price of a smartphone TCO.

I'd still take mine to organise a lift to my car after landing. I didn't say you must take one. Just that it's convenient for many reasons and most people do it.

I live in the suburbs. Used to not being able to come back because of a delay at the airport, trains incidents, and no one available to lift you.

Thus, staying in a gloomy airport or train station being jet lagged and having hallucination because of sleep depravation while waiting for the first train, and urging to not sleep to be sure I will neither miss my stop nor get robbed while sleeping.

Once you experienced your fears and survived them, you lose them and gain confidence.

I now kind of enjoy this «voyage au bout de la Nuit».

I travelled on a two week holiday recently, and pretty much all of our itinerary was stored on my phone. Boarding passes for flights, transport info, airbnb/hotel booking info. We also had local maps, and Tripadvisor info preloaded for the area.

Not having a phone is not going to seem suspicious. Even in the US, there are still people who don't own cell phones. About 5% according to the Pew Research center, after I took the difficult step of Googling it.

Plus, some people don't have an international phone plan, or compatible charger, so they just leave the phone behind.

But what's the number of people who don't own a cell phone and travel internationally. For example Amish people will be in the first category, but not the second. Same with many older people.

Given the state and costs of international roaming this is when you are least likely to have your phone. "Sorry officer, my phone is at home. Or is carrier locked and given roaming costs it is going to be cheaper for me to buy a phone and pay as you go plan here. Are they any shops in the concourse that you might suggest for getting one?" A pocket camera and list of phone numbers completed the set. Obviously don't lie if you actually have a phone, but not having one is not sufficient ground for detention.

I own a cell phone, but I've always left it at home while traveling, even before the nutjobs took over the country. I don't have an international data plan and don't trust public wifi, so I travel old-school. I think the author of this article is misguided about how suspicious it is to have no devices while traveling.

A surprising number of Amish have cell phones.

http://lancasteronline.com/news/local/cell-phones-computers-...

This guy says that I would be arrested by the CBP if I want to visit my brother because I do not see the interest of device other than a camera going to Florida (near the beach), and no phone because my old nokia is not dual band (I find the TCO of modern smartphones way to high for my slim budget).

OK I do take a laptop 0.8 with infinite battery, full OCR and cheap printer: it is called a notebook and a pen (cost 5$).

Hence, thrifty persons are all suspect when going to the USA according to the author.

Nice mentality!

He is right in a way, I cannot afford to visit my brother so I wouldn't really have the problem, but when I my finance will get better, I will not revert my habits: electronic devices are a cost and time sink thus I learned to live less.

> that I would be arrested by the CBP

That was a sarcastic bit. Later:

> If you are completely naked of any digital devices but aren’t 2 or 80 years old, then you are extremely anomalous. Most probably someone that should be interviewed by secondary CBP screening…

Secondary screenings happen all the time. Especially for anomalous people. I keep getting one.

I don't travel that much anymore, but as recently as 5 years ago I traveled many weeks a year for work. So I have an old travel backpack with a laptop sleeve and about a dozen pockets, I've cut off some straps and buckles as they have become frayed and useless but I still use it, mostly in my office, hung on a hook to keep certain items like survival gear, knives and firestarters away from my kids (I work from home and you can see where this is going)

We traveled across the U.S. last week for an important family even. At the 11lth hour in a moment of thrift and panic as I realized my 5 children had commandeered my normal carry-on and luggage, I snagged the old travel backpack, dumped its contents on my desk and began packing.

13 hours later as my happy brood gathered at the benches on the other side of the lemmings line I realized something was wrong as the scanner belt kept going back, and forth, and back with the scanner maw right around, I guessed, the location of my ill-fated backpack.

15 minutes later when an elderly TSA agent finally found the 10 inch 1/4 inch thick black coated survival blade[0] in between the padded lining of the laptop sleeve and the back pad (a perfect place for an idiot, paranoid, delusional to hide an implement of murder) I was certain I was in for the full cavity treatment much as my ragged backpack had been.

I'm convinced the only reason i was able to check my carryon WITH the knife inside it after being perfunctorily and even gently escorted back to the check in counter is because I myself was so convinced of my innocence and lack of contraband.

When asked if I had anything sharp or dangerous in my pack I answered a quick and unabashed "nope" fully convinced of my own lie and maintained this demeanor until 15 seconds before they pulled the knife from thin air - only being persuaded of my deceit after seeing the fully empty bowels of my pack and remembering its former contents.

[0]https://www.topsknives.com/media/catalog/product/cache/1/ima...

Also I heard that there is a legal precedent that if the government confiscates your drugs you can attack them and demand reparations and they will have to pay.

https://en.wikipedia.org/wiki/First_Opium_War

> Usually phrased as “I don’t know my password it is in a password manager which I can’t access.” Or, “there is 2FA setup and I don’t have my second factor.” Or other similar technicality. This approach seems to be based on the belief that the password itself is the ultimate goal of the system, when it has been clearly stated that the goal is access to the content of the digital device or the social media account as a requirement for entry into the US.

So what is the recommended solution then if I use a password manager? I don't know any of my passwords and for most websites I'd need the password manager on my laptop to login. Should I reset my social media passwords to a password that I can remember before traveling, so that I'm able to surrender the password if asked at the border?

ESTA applicants are apparently now required to write their Facebook password on the application form. It sounds like changing it to one you remember/write down is the only answer. Or brazening out the "I don't have facebook" route.

Are you mistaking this for the ESTA application form allowing people to enter their social media handles?

> So what is the recommended solution then if I use a password manager?

Open the password manager, find the password, and write it down.

I don't have my personal laptop with me when travelling (because personal phone and work laptop is sufficient). So that's not really an option.

Perhaps I just missed it (it's late), but I couldn't find anything in the article backing up the author's claims about how those strategies would play out.

Was this just a record of his thought experiments?

A different article should have been written to a different audience, namely, the border agencies in the US. Seriously, asking for passwords to social networks and websites crosses the line, in fact even examining the content of the devices is walking the line.

Border protection agents should worry about real world threats - bombs, weapons and such. Not virtual ones. It's totalitarian.

'the grugq' has left us with a complete cliff-hanger:

"Good travel advice to follow in a later post…"

which will be composed of just one line: "just avoid the US for now"

What if they ask for your online account passwords?! What should one do?

Not travel to the USA.

I live in the US

My commiserations.

I think the advice still holds, unfortunately. Don't travel across the US border :/

The situation is far worse than that:

https://www.aclu.org/other/constitution-100-mile-border-zone...

Wow, I wasn't aware. I'm sorry. That's awful.

This applies only if you "recently" crossed the border - allegedly, but if CBP ignores the law, you can't really do much, and the courts usually side with them.

What about having two (or several) sets of devices, each sets having "a life", software installed and used etc?

A laptop and smartphone for travel and another set for home.

I am curios if they can make you log in (thus reveal all your secrets) to THEIR generic Android or iOS phone if you don't carry your phone on purpose.

Not that I think those pieces of advice are particularly good but what does the author suggest other than surrender?

His post is basically saying "There is nothing you can do about it just surrender.".

> Good travel advice to follow in a later post…

An aching desire for reality to be different doesn't imply that the advice isn't correct.

So anyone that routinely wipes their device or doesn't travel with them is a criminal, and your best bet is to just comply and hope they're lazy. How does following any of that advice help the civilian? I only see how a lower adoption rate helps the border patrol.

It's only meant to intimidate people. There is no way it could serve a real security purpose.

IANAL either, but the author seems to have missed the point of the "I don’t know my password it is in a password manager which I can’t access" one (or, indeed, the blank device — but this one has numerous advantages). Yes, this will piss off CBP and they will punish you for it, and especially I wouldn't recommend it if you're not a US citizen but are desirous of entering the US. But if you're a US citizen, CBP isn't about to risk their position in court: they will not detain you indefinitely for noncompliance especially when you have an entirely plausible (and true!) explanation for your inability to comply.

Reply on news.ycombinator.com