Hacker News Reader

Comment by gist | Hacker News Reader

I don't want to be that 'if you've got nothing to hide then' guy but why are people so worried about what border agents in particular will see on their cell phone?

I am not saying that I wouldn't mind at all if my phone was searched. But I can't think of anything in particular that I would be concerned about if it was. Sure in theory the agent could remember some personal information and come back later and use that info or pass it to someone for some nefarious purpose. But that's a pretty small chance event. It's more or less the equivalent of thinking you will get sick because you find a hair in your food at the restaurant. You don't like it and you send it back or demand a refund but the actual harm is more mental in nature.

Or what am I missing here?

View on HN

There's lots of stuff I'd rather not be seen by strangers. Love notes to/from my wife, love notes to/from my mistress, photos of myself or others that I'd rather not be seen by strangers, financial information (through online banking apps, etc), just to name a few.

How do I know the agent isn't downloading the naked pictures of my wife? (There are lots of reasons to not keep such pictures on my phone, but "Because border agents may see them" should not be one of them)

And there's just the futility of it -- if I really had something to hide from the government, I wouldn't keep it on my phone (or if I did, I'd keep it hidden).

the actual harm is more mental in nature.

That doesn't make it any less real - the government should not make me feel violated.

This was a particularly concerning case: https://www.theverge.com/2017/2/12/14583124/nasa-sidd-bikkan...

    Bikkannavar says he was detained by US Customs and Border Patrol and
    pressured to give the CBP agents his phone and access PIN. Since the phone
    was issued by NASA, it may have contained sensitive material that wasn’t
    supposed to be shared. Bikkannavar’s phone was returned to him after it was
    searched by CBP, but he doesn’t know exactly what information officials
    might have taken from the device.

Once he unlocked his phone, they were gone with it for 40 minutes. Plenty of time to copy the device contents and peruse at their leisure.

Depends on how difficult it is to produce an automated system whereby one needs only plug an unlocked phone into a computer in order to hoover up all locally-stored messages, contacts, saved passwords, synced browser histories, etc. The agent themselves doesn't need to care, they can just be instructed to "unlock the phone, plug it in to this computer, wait until the progress bar finishes, hand phone back". Are you on Github? Is your Github password saved in your browser? Do you have commit access to any marginally important projects? God only knows who has commit access to those projects now. Considering this is HN, I imagine this is an attack vector that a lot of people here are particularly concerned about. Given how much code we use that's written by others, it ought to concern the rest of us as well. :)

This is not an attack. This is iTunes. This is trivial to do.

Not sure why you have been downvoted, since it is a valid question and you phrased it in a productive way.

I think the reason people focus on border searching so much is that it's presumed to be one of the easiest entry points for the government to spy on you.

Many security researchers, such as people who work on Tor and related technologies, have had their electronics searched and sometimes seized at the border. That makes it particularly relevant to the HN crowd.

For me, I seriously doubt the government would ever be interested in my data. But imagine that the CEO of my company is suspected of some kind of crime. Perhaps when I am at the border they try to image my phone, in order to get access to things which may allow them to control other company assets (servers, etc), which would get them closer to their target.

I doubt it would ever happen to me, but I'd rather take precautions. Being searched at the border seems much more likely to me than, say, the NSA/FBI targeting me remotely with malware.

My Canadian friend (woman) made the mistake of making a connecting flight in the States on her way to visit me in Mexico.

The border agent accused her of prostitution. He wanted to get into her phone to see her latest Facebook Messenger and Tinder correspondence. She let him because, of course, it's easier than canceling her entire vacation plans.

Now, the tips in this thread wouldn't have helped her. But do you see how it's not just "I don't have anything to hide?" What about not letting some border agent power trip all over you? Reading your Tinder messages for fucks sake?

What if they automate the search and copy all your data for further mining and save all that info to see if you're not "desirable" for the "people in power"?

It’s not about agents looking at your phone; it’s about the slow erosion of our rights among other things

It is not only you. It exposes everybody to be blackmailed by the government or who every gets hold of the information. Judges, politicians, businessmen, scientists, journalists, etc, etc. It weakens the democratic fabric.

I'm not sure if it's relevant but Dubai and UAE have been known to put people in prison for quite unbelievable reasons often as they were transferring through the airport.

One such instance included a British guy who had shared a Facebook post recommending giving aid to refugees, Dubai police put him in jail over it - that was over a year ago and I believe he's still there. One instance included a microscopic amount of cannabis found on the sole of a passengers shoe, he got almost 4 years in prison.

There are many many other instances, if locking your phone stops them from even chancing it, it might be worthwhile.

What I worry about is Google Authenticator codes for several financial institutions, getting vacuumed out of the phone with everything else and stored on some insufficiently-secured database.

One phrase I've used with success in the past is that I have secure governmental cryptographic codes owned by someone other than myself in my laptop/bag/iphone and am not allowed under law to disclose them to unknown parties such as yourself.

Most first level TSA/DHS people measure the cost/benefit of my assertion and back off.

Just because you are innocent and have nothing to hide, it does not mean they cannot still use the evidence you provide to convict you. Basically, it comes back to the same reason that many lawyers generally advise you to never talk to the police (1). IANAL.

(1) https://www.vice.com/en_us/article/mvkgnp/law-professor-poli...

Do you have any work data or email on your device? What is your employer's policy about granting 3rd parties access to such data? Could you be fired for doing so?

The issue is that they can compel you to unlock the phone and then make an image of the phone's contents which would allow them to clone it to another phone. They would then have full access to everything on your phone including any linked accounts and cloud services.

What's on your cellphone today; who knows what it will be tomorrow.

I'd personally much rather the State fundamentally respected a right to private and family life, much like article 8 of the ECHR, but fat chance of seeing that in the USA any time soon.

Reply on news.ycombinator.com