Hacker News Reader

Comment by chx | Hacker News Reader

"May I search your laptop?" "Certainly." "But... this is practically empty." "Yes sir. I FedEx'd my SSD to the destination."

I have a small SSD in the primary disk in my T420s, it has just enough to get me through the flight. I keep the primary in the UltraBay with a simple adapter, takes one reboot and no tools to put it back in place. Done. Happy searching! I can't log into anything even if I wanted to because I physically do not have my password store https://www.passwordstore.org/ with me. (https://github.com/chx/ykgodot I wrote this trivial script to automate yubikey neo with pass)

Alternative: encode the entire primary disk https://github.com/cornelinux/yubikey-luks and FedEx the yubikey. Yanking the disk is better, though.

View on HN

It's a practical approach, and my comment here isn't necessarily aimed at you, chx (since I don't know your citizenship status), but I would add this entreaty to American citizens like me:

If you ever get asked that question at the US border, please don't acquiesce to that request. They have the right to ask, and they even have the power to search it regardless of your permission, but despite an alarming drift towards a total surveillance, they have not established the right to force you to unlock/decrypt anything.

I'm flying into SFO tomorrow, and I am taking similar precautions as chx so that my laptop doesn't contain any meaningful data[1].

However, if asked to unlock my laptop, I plan to say "No, of course I cannot do that; it violates the most basic security practices and I could and should be fired if I exposed sensitive company data in that manner." And then just sticking with it. It will be inconvenient, especially if they seize my laptop and detain me, but as citizens it is up to us to resist the normalization of behaviors that push the nation further towards the precipice of idiotism.

[1]: As an American citizen, I have routinely done this when traveling to authoritarian nations like China; it's hard to express how outraged I am that my own country has degenerated to the point where sound security practices now require these kinds of procedures when traveling to the USA.

> If you[, a citizen of the United States,] ever get asked that question at the US border, please don't acquiesce to that request.

Absolutely agreed. I will do this[0]. I'm a U.S. citizen with the unequivocal right to enter the country once my citizenship has been established. U.S. citizens are the only ones who can stand up to this madness--either at the border or by influencing and electing people who can change the written law and how it is enforced--and it's our responsibility to do so.

I've entered the country several times and have never gotten more than a "passport, please" request (except, oddly, when driving south from Canada; they're rather surly at the Peace Arch, in my experience), which I recognize is very lucky of me. When I travel, I'm enough of a worry-wart that I build in a lot of spare time to get to and from my destination. "Do you want to fly today" and "you'll be screened for four additional hours" are threats that hold no weight with me, thankfully. I'm in no hurry.

I'm the ideal test case. I have oodles of paid vacation time, a family full of lawyers, and a ornery streak a kilometer wide. Bring it.

0 - I can't say "I have done this" because it's never come up but I'm resolute. "No" is my answer, if it ever does, and I'm sticking with it.

I have been that guy. All of 2009-2013 or so.

After being locked in secondary with no comms, food, or water for hours on hours enough times, one gives up. CBP once kicked me out of a border control point in northern Vermont, in a snowstorm, in February. I had to hitchhike simply to not freeze (my sim didn't work, so no way to call a cab, and they had sent the bus on without me, hours earlier).

I've been searched, both well and also simply as intimidation, more times than I can remember. Most searches are not thorough in any capacity, but simple displays of power and dominance.

My foreign partners have been repeatedly groped by these pigs. Vacations have been ruined simply by traveling together - they deny foreigners entry.

The file still haunts me. Every time I enter, secondary - with associated 30-500 minutes of delay.

There's no recourse.

I cringe every time I exit the US, for the 2-10 hours I will lose upon my next re-entry.

Their capacity to waste your time is infinite. Your time is finite.

PS: they can also take all your devices for imaging and keep them for 48 hours - but you will likely have to sue them to get them back after that time. Crossing in can be a >$10k/entry affair if they wish it to be, for you.

This sounds like the reprisals citizens of the totalitarian states in the Warsaw Pact had to endure. Heads up for pushing against it.

Out of curiosity, do you know if there are any people trying to challenge these rulings/treatment they receive in court?

At least in those - and I'm sure this still happens - you could bribe the officials.

Actually is that possible in the US or do the border officials still have a stick up their arse? I mean if you work for a big multinational IT company, surely they can provide a few hundred bucks to bribe someone to skip security. Bribing the police is normal in a lot of countries.

Yeah. My father described the experience of crossing borders between East Germany/Poland/Belarus/Ukraine in the 80s early 90s as the exact same theatre -

" -sir, we have to strip your car to search it for contraband.

-Ok, how long it's going to take?

- About 24-48 hours, but it might take longer if we see anything suspicious

- ok, what do I do in the meantime?

- you can sit on the bench there

- for 48 hours?

- that's correct

- I happen to have this nice bottle of vodka, would you like it as a thank you for your hard service?

- hmmmm I have to check with my superior [ comes back 5 minutes later] - that's fine, we don't need to check your car today, have a safe journey"

Nowadays I'm being told that this practice has been eradicated almost everywhere, but it basically relied on border control agents making your life as miserable as physically possible in hope that you will pay up. If you decided not to, they would eventually let you go, but you're wasting only your own time, they had infinite amount of it and perfect justification for everything they did.

You can get a 10 year prison sentence or so for bribery. In any country in the world, you can be prosecuted there, or in the US or Europe. You will probably also be fired.

> You will probably also be fired.

Please elaborate on that.

Any large company has an ethics code. Bribing government employees is usually a rather big no-no in that code.

Any large company also makes allowances for differences in local laws and customs when applying their ethics code.

Yeah... no. (The FCA[4] makes that fairly hard)

Amazon: "Employees may not bribe anyone for any reason, whether in dealings with governments or the private sector. " [3]

Apple: "Apple does not offer or accept bribes or kickbacks in any form, and we do not tolerate corruption in connection with any of our business dealings." [2]

Google: "The rule for us at Google is simple – don’t bribe anybody, anytime, for any reason."[1]

[1] https://abc.xyz/investor/other/google-code-of-conduct.html [2] http://files.shareholder.com/downloads/AAPL/0x0x803576/DAFD8... [3] http://phx.corporate-ir.net/phoenix.zhtml?c=97664&p=irol-gov... [4] https://en.wikipedia.org/wiki/Foreign_Corrupt_Practices_Act

Thank you for sharing your experiences.

For future, for the rest of us, I'm wondering what civil disobedience would look like. Something akin to malicious compliance, work to rule, or...? Actions (or inactions) that we can take to make the whole process infeasible.

For example... Whenever a telemarketer cold calls me, I try to take up as much of their time as possible. Increase their costs, reduce their conversion rate.

I also try to lie as much as possible for forms, surveys, etc. Muddy the data. Increase their costs.

> PS: they can also take all your devices for imaging and keep them for 48 hours - but you will likely have to sue them to get them back after that time.

You don't really want them back, anyway. So you just don't carry anything valuable, in any sense.

If only running three companies afforded me the ability to be without a computer, phone, or tablet for 24-48h while they are shipped/replaced.

That's called a vacation.

What you describe is simply impractical for a person in my line of work.

If you're running three companies, you can carry throwaway devices.

You misunderstand me; it is not the issue of the cost of the device, but the 2-4h on each side of imaging and restoring (for mobiles) or the 4-8h on each side for computers.

Employees can handle imaging and restoring. You can send an employee in advance, who will have devices ready for you on arrival. So all that gets handled while you're in transit.

When you can't even trust your own Blood Boy [1] not to get stoned, eat twinkies, and write a tell-all expose about you, how are you supposed to hire an employee trustworthy enough to handle all of your most sensitive keys and information? (Let alone three of them, one for each company.)

[1] https://www.theverge.com/2017/5/22/15676696/hbo-silicon-vall...

If you have any methods for hiring employees trustworthy enough to backup and reimage my most secure computing device with the most sensitive data, and somehow do so on notice given only via ESP, at several major world airports, please do let me know.

I guess I could get a fourth phone, the one I use only for talking to my Airport Phone Guy, who would somehow be incorruptible enough to not hijack my bitcoin wallet or take copies of my camera roll (which, if used strategically, could alternately make or ruin entire careers or companies).

I'll be over here in the Real World.

I don't know smartphones. But for machines with SSDs or HDDs, imaging and restoring software FDE volumes doesn't involve decryption. I don't know about hardware-based FDE, however. I use Linux VMs, and you can just copy LUKS-encrypted VDI files. If you're paranoid, you can backup and wipe the LUKS header, and send it separately.

Thanks, but my phones and tablet are my primary systems and even just resyncing breadwallet alone takes a half hour or more. You have no idea what you are talking about.

Can you just keep your devices stateless? This works for me.

Any idea why this happens to you? Your story suggests some targeting.

I was once on a list that got me secondary searching every single time I flew in the USA, for several years.

This was back in the 1990s, when asking for your password wasn't a thing I've ever heard of them doing, but also when me bringing 128-bit encryption software (aka the US version of Netscape Navigator) to Japan, where I was a foreign student, was a serious crime akin to arms smuggling.

Of course, I never found out for sure why I was on that list, and eventually I apparently wasn't on it anymore. But during that time I did read a fascinating article in some magazine, by Nathan Myhrvold (the now-infamous patent troll scumbag). Apparently, he was on the same list, despite being a super rich fat white guy from Microsoft.

His theory was that he got on the list by buying one-way plane tickets in cash. That resonated with me, because I often did the same thing back then… I just never really knew when I wanted to come back, and I didn't have much credit on my one credit card.

That's obviously both circumstantial and anecdotal, however I don't think it really takes too much to get on one of these secret (and very probably unlawful, but effectively un-challengeable) lists.

> he was on the same list, despite being a super rich fat white guy from Microsoft.

What could the "fat" part of that possibly have to do with anything related to targeting, other than as a cheap excuse for you to denigrate Myhrvold?

Well, I really just meant it more in the sense of him being a typical/normal/mainstream/not-unusual American.

But also, yeah: fuck Nathan Myhrvold. He's a smarmy piece of shit whose parasitical exploitation of America's societal weaknesses and dysfunction far outweighs all the modest contributions he's ever made. I hope he trips and falls face-first into one of his large sous-vide contraptions.

(That time, I was denigrating him on purpose.)

Thank you for this.

Probably means he looked more "safe" and "complacent" and that didn't stop them.

Myhrvold is a scumbag now, but back in the 90's he pulled off a heroic fuck you to NSA.

NSA didn't want to allow Microsoft to build RSA into Windows and export it. Even though the cat was out of the bag and foreign OEMs and vendors were already selling RSA. NSA wanted Microsoft to not give users more than 40 bits of encryption keys.

So Myhrvold, as President of Microsoft, flippantly offered to pad the keys generated by Windows with NSA's public RSA key. Win Win. Users can export more than 40 bits, and NSA gets a backdoor.

Microsoft won and was allowed to export software using RSA. No doubt that little stunt put Myhrvold on some Watchlist for Life.

It's too bad he became evil after he became a billionaire and started only caring about money and Yachts and hob knobbing with other 1% elites.

For five years or so, I (a US citizen) politely but firmly refused to answer a single question put to me whilst re-entering the United States, as is my human right.

Not even "Was your trip business or pleasure?"

Border guards have the power to prevent you from entering the country if they believe your business is unlawful, and asking those questions is one of the ways they decide. We can question whether border guards ought to exist, but, given that they do, refusing to answer their questions seems like a ticket to a back room for hours.

You really never answered their questions on every entry?

The fifth amendment does not go away suddenly at the border (4A notwithstanding).

If exercising my human rights is "a ticket to a back room for hours", then something is fundamentally broken in our society. You should try it; without doing so you actually have no data about the practical perimeter of your basic rights. This stuff isn't printed in the newspaper.

Yes, I really never answered their questions, except the ones about citizenship and nationality and place of birth—which I answered by presenting my passport.

"Business or pleasure?" is a vague, leading question designed to get you to volunteer as much information as possible. Sometimes I replied "no" or "yes" to that one, with an occasional "On advice of my attorney I decline to answer questions from police except in writing and via counsel" thrown in to break up the monotony.

Never talk to the police.

> Border guards have the power to prevent you from entering the country if they believe your business is unlawful

No. The USA can never deny entry to citizens (nor any other country). They may arrest you on the spot, but can't deny you entry.

Green card holders is a different story, they have no right to enter and are at the discretion of the authorities.

I don't believe they can prevent US citizens from entering the US.

Is the goal to resist normalization of the behavior or is to get through the security theater?

Both, but for non-Americans, getting through the security theater is not guaranteed, so they have to focus on that. For Americans, their rights are clearer and they are guaranteed to get through the security theater, so they can afford to fight the normalization of this.

It depends. Sometimes, it's really important, and you have to make it through quicky even if that means sacrificing other principles.

You have to balance your civic duty as a citizen with whatever else is going on. But hopefully our default mode is to emphasize our responsibility as democratic citizens to lead by example, and to resist degenerate behavior whenever we can...

Obviously veidr's goal is to resist normalization of the behavior.

I am a dual Canadian-Hungarian citizen, residing in Vancouver, BC, Canada. I work remotely for a USA client. Avoiding the USA is hard / impossible.

> "May I search your laptop?" "Certainly." "But... this is practically empty." "Yes sir. I FedEx'd my SSD to the destination."

Scratch that last bit. There is no need to reveal that, and it could sound suspicious (like you are trying to hide something specific by circumventing their checks, and trying to look clever (and/or make them look dim) by doing so to boot).

Just be honest without giving extra information: "yes sir, this is a travel machine and it just contains what I'm going to need while I'm between locations" if they ask why you would do that then "in case the laptop gets stolen, the less that is on it the less of a worry that could be" strikes me as a perfectly valid reason to be careful. Or perhaps "all the other data and programs I'm going to need are already with the clients/suppliers/other I'm visiting" (which it is as you've posted it, but you don't have to say the thing that might unnecessarily raise suspicion).

> I FedEx'd my SSD to the destination.

Are there any examples of laptops / ssds being searched in international mail?

If you take the time to FedEx your SSD to avoid customs you certainly made sure the disk was encrypted...

NSA can probably modify the firmware to create some sort of backdoor, if you actually look like that would be worthwhile?

Maybe the NSA can, maybe the NSA can't - but even if they could, I guarantee that customs/postal workers won't have access to it. Unless the NSA is specifically intercepting your particular SSD (in which case you have much bigger problems), standard enterprise-grade encryption will be good enough for shipping purposes.

This goes back to the level of protection you need/want, from whom, and whether you're a target of opportunity or a specific target.

Are you protecting against "drive-bys", the casually curious, motivated low-resource targeted attacks (e.g. disgruntled former employees, hated neighbors), "small" resource targeted attacks (<$50k?), high-resource attacks or state entities?

That would take a lot more work than just "searching through someone's private stuff on an airport" though;

I mean many "average" people get searched on airports, but i don't see why they would intercept an average guys Fedex shipped harddisk and do some voodoo on it. Unless of course you know you're being targeted for some specific reason.

If this is in your threat model, you shouldn't be taking advice from a forum thread.

Probably?

Snowden leaks already show NSA has badbios-style firmware viruses targeting every manufacturer, every model, going back a decade. Imagine what they have today. Why not mass infect all hard drives at the factory? Targeting individuals or "thematic warrants" are still too clunk and doesn't scale.

All these folks who say "I'll out smart them, I'll encrypt my SSD and Fedex it" are "Not Even Wrong."

http://www.spiegel.de/media/media-35661.pdf

As most encryption takes place at the software level, not the hardware level, wouldn't it be difficult to infect all hard drives with some virus targeting encryption?

Also, not to mention most of my hard drives are made by China, whom seem not to like the NSA very much. This leads me to believe that they may struggle with the mass infection part.

You forgot the end of the story:

"I'm denying you the ability to enter the country. Next time you let me see everything instead of being a wise guy."

If you are an American citizen, can they prevent you from entering the country? I understand they can delay you, but I don't think it can be indefinite.

^ This right here.

They can deny foreigners, but I've always read that they cannot deny Americans in unless their citizenship gets revoked, I guess.

Not even that. Your right to enter the country, as a US citizen, is "Absolute, Unconditional, and Irrevocable."

"Why did you FedEx your SSD to the destination? Do you have something to hide? You're gonna have to follow us."

"everybody's got something to hide! I've got nothing hidden that's illegal."

If they find even one pirated song on your drive, they've got you on a felony. "Lying to federal officials" is a great catchall they regularly use to force a deal.

That's now.

The future is simply interdiction of every device.

Actually, every device will just be bugged with a thousand backdoors. The end.

Cory Doctorow - general computing is the enemy of governments.

Reply on news.ycombinator.com