Questions for TSA after reports of laptop and phone searches on domestic flights
theguardian.com
theguardian.com
> Modern cell phones are not just another technological convenience. With all they contain and all they may reveal, they hold for many Americans “the privacies of life". The fact that technology now allows an individual to carry such information in his hand does not make the information any less worthy of the protection for which the Founders fought. Our answer to the question of what police must do before searching a cell phone seized incident to an arrest is accordingly simple -- get a warrant.
Given that the SCOTUS unanimously ruled searching a phone without a warrant is unconstitutional incident to an arrest, the same requirement must also hold for Terry stops and simple safety inspections.
That is what all the TSA searches have appeared like to me. Just a denial of service for maintaining a level of privacy.
You know what, you really don't. Your rights aren't supposed to be just a legal burden to circumvent with various tricks, they're supposed to hold in all domains of public life. I want to be able to fly in a plane without having some asshole dig through my personal life. You think someone is dangerous? Check for bombs. Check for weapons. Why are they checking for beliefs? What kind of bullshit is this?
For example, the 9th circuit court of appeals in U.S. vs Davis[1] held that airport searches are "administrative searches" and are permissible in much broader ways than searches while being arrested.
[1] http://cdn.ca9.uscourts.gov/datastore/opinions/2005/06/07/04...
> The procedure is geared towards detection and deterrence of airborne terrorism [...] This was a limited search, confined in its intrusiveness (both in duration and scope) and in its attempt to discover weapons and explosives.³
> ³This would, perhaps, be a different case if there were improper motives established by the record below or argued in the briefs.
I'd like to know what "weapons and explosives" that might be useful for "airborne terrorism" the TSA thinks it might find buy searching the data on a laptop or phone.
You must show your work here.
https://en.wikipedia.org/wiki/Terry_v._Ohio
A narrow search for weapons is permitted without probable cause, if the officer has "specific and articulable facts" that someone "may be armed and presently dangerous". Terry stops can allow a pat down for weapons; an actual search outside the scope of the immediate safety of the officer still requires probable cause and a warrant as usual (where the Riley decision would apply).
I'd like to know what kind of weapons the TSA might be looking for if the consider someone with a laptop or phone "armed and presently dangerous".
> simple safety inspections.
https://en.wikipedia.org/wiki/Michigan_Department_of_State_P...
Briefly, Michigan Department of State Police v. Sitz allowed a brief questioning to gain "reasonable suspicion" of a crime (i.e. drunk driving), but only because it negligibly impacted 4th Amendment rights. Actual searches still required probable cause or arrest (Riley again), or the infamous "plain view" exception. Don't leave anything incriminating in "plain view" on your device's screen.
If I understand it correctly, the TSA is not forcing anyone to unlock devices. They take the devices away for some period, but if they’re securely locked, TSA won’t be able to get anything from them.
However, the article drops border searches which do require an unlock right into the middle of the article, then goes on to say that they have no specific examples of TSA doing the same thing. This implies that they have reason to believe it’s happening, but as far as I can see there’s no justification for that.
The big question is: what are they doing with these things? If it’s some fancy explosives sniffing (like they already do to my contact lens solution) then it’s nothing interesting. If it’s an electronic search if unsecured devices, that’s bad. If it’s an attempt to force travelers to unlock secured devices, that’s horrible. The article seems to want to portray it as the last one, while only giving evidence for one of the first two.
I'm sure they also don't shrug their shoulders and say "Locked? Oh well.". Varying degrees of coercion, threat, implicit or otherwise, relying on passenger ignorance to their rights.
I wonder how many have unlocked it at their request too, which is specifically different from "forced".
That’s my whole point: this article appears to be written to make you assume that a lot more is going on than they actually describe.
This is what bothers me the most about TSA and Border Agents stamping on rights - there's the implicit "we're going to waste at least 1,300$ of your money by forcing you to take another flight and rebook hotels." I get so stressed about it I show up at least 3 hours early for any flight, sometimes even 4 for international.
You have no way of knowing that, or if they are doing anything to the hardware, cloning the SIM, adding tracking, or simply cloning the flash for possible evaluation later
Further it should be considered unconstitutional for them to even take it for 1 second.
> If it’s some fancy explosives sniffing (like they already do to my contact lens solution) then it’s nothing interesting.
I would find it interesting and "bad", they should not need to remove the device from your view to do explosive sniffing.
It is very troubling to me how much invasion of and infringement on a persons liberties the average person is willing to accept in the name of Security Theater
Searching electronics for explosives isn’t security theater. That’s a real threat vector and an effective counter to that threat.
Swabbing laptops for explosives doesn’t sound like security theatre to me.
Countless of time they have failed Red Team testing, TSA is useless if your goal is actual security, they are pretty good if you want to shift people in to accepting more and more intrusive violation of their rights...
It is well documented that there is no cell phone that cannot be unlocked.
And once it's unlocked, who knows what the real goal is. On the surface, one suspects that it's to examine its contents. But other possibilities include sideloading spyware, or even targeted viruses. Some random NGO secretary may not be the actual target, but could be the vector that allows a program to spread to one or more other targets within or without the organization.
I liked it better when this was the sort of thing that people on shortwave radio with tinfoil hats would rant about. Now it's almost weekly headlines in the NY Times, Guardian, WSJ, etc...
http://iphone.appleinsider.com/articles/18/02/26/cellebrite-...
Citation needed?
For every other phone, Google is your friend.
I get it, burden of proof. The blanket statement by OP also doesn't consider the ol' "baseball bat" ceiling of hacking strategies - at what point is it easier to just break someone's fingers until they tell you what you want to know?
(don't break someone's fingers that's not good)
Ok, probably true, but that doesn't necessarily mean that any unlock can happen quickly, or that the TSA has that capability broadly deployed to agents, or that the TSA even wants to unlock devices.
Since this is a different agency than typically conducts (similarly intrusive and seemingly illegal) searches in the case of international flights, I wonder if they are following a common protocol? If so, who creates that?
I'm about to fly internationally for the first time in a while; anybody have any advice on how to handle my devices?
I recommend one of these:
https://www.amazon.com/MyDigitalSSD-480GB-SuperSpeed-Portabl...
Keep it encrypted and in your pocket.
Not sure that's the case: TSA agents are not police or any other law enforcement any more than the gate agent is,and can't make arrests or anything like that. Pretty sure you can say what you like (though please, be polite!).
I once pulled out my phone to photograph the badge of an agent who was particularly obnoxious, not just to me but to others. I planned to fill out the complaint card. He freaked out, told me photography was not allowed, grabbed me by the arm and called for the cop. The cop came over and told him in no uncertain terms to let go of me, that photography is fine, asked me if I got a clear photo and made sure I got a photo of the badge. And handed me a complaint form. I assume he already knew that the TSA guy was a jerk.
Aren't TSA agents government, federal, employees?
https://www.law.cornell.edu/uscode/text/18/1001?qt-us_code_t...
> Except as otherwise provided in this section, whoever, in any matter within the jurisdiction of the executive, legislative, or judicial branch of the Government of the United States, knowingly and willfully—
> (1) falsifies, conceals, or covers up by any trick, scheme, or device a material fact;
> (2) makes any materially false, fictitious, or fraudulent statement or representation; or
> (3) makes or uses any false writing or document knowing the same to contain any materially false, fictitious, or fraudulent statement or entry;
So maybe one of these instead:
https://www.amazon.com/Samsung-microSDXC-Adapter-MB-MC256GA-...
Of course the TSA is not so unsubtle as to actually hit you with a wrench, but they have other ways of making your life miserable.
Maybe I’m being obtuse but can you explain how it protects against a wrench attack?
I guess it depends on your definition of "trivial", but I wouldn't want to bet my privacy on the TSA's inability to locate a hidden partition any more than I would want to bet it on their basic honesty and respect for my Constitutional rights.
The advice I hear for international travelers is disk encryption + FedEx'ing your laptop to its destination.
The only safe assumption is the worst case.
Even hidden volumes in encrypted partitions? Has that feature of VeraCrypt been cracked?
Giving up your phone also means they get a complete copy of your email.
If you use a VPN to access company servers they will swoop up that information as well, and by extension all server side data your VPN credentials Grant access.
They may not be doing all that, but it's only a matter of time and knowledge given their lack of constraints.
Just make sure you have Auto Call off in Settings > Emergency SOS, or it'll automatically dial 911.
Also, you can have a digit pin code longer than 6 digits by using a passphrase with only digits.
Ah, you know what, I get it. They want to bring back the 90's cryptowars. They will lose again.
In other words, stop flying completely. Because with that reaction, you're not getting in the plane.
It's not good advice if you are an individual who just wants to avoid the inside of a prison cell, and it's definitely dangerous, but I'd still admire anyone with the strength of character to follow through with it.
It's also terrible advice in countries where the preferred solution is simply to murder loud activists. At least you can theoretically be released from prison.
I'm less sure about an individual reading that advice and swearing at a border guard. Both Ghandi and MLK used mass resistance to achieve their ends.
If you're an American returning from abroad, my understanding is the most they can do is detain you (briefly) and confiscate your electronic devices for a limited period of time. Americans can't be denied re-entry to the US. So go ahead and refuse as a political statement, the worst that could happen is you'll miss your connection and you'll have to use a temporary phone for a bit.
But if you're a foreign citizen, it's probably best to swallow your pride and comply.
Detentions have lasted more than 24 hours though, sometimes for days:
"Median Number of Hours Individuals Were Held in Detention, by Sector"
Are you trying to bring 3 phones, 2 laptops, a tablet, 4 chargers, and assorted other electronics with you? Be prepared for the long arm to reach into your life because you're attracting suspicion. You would be attracting suspicion even without the current political climate, because that much equipment is outside the bounds of normal for your average traveller.
Be an average traveller and no one will give you a second glance.
I suspect it would be very revealing which nonprofit is involved here; this kind of harassment through scrutiny is a classic tactic against progressive groups.
https://www.npr.org/2017/10/27/560308997/irs-apologizes-for-...
https://www.washingtonpost.com/powerpost/liberal-groups-got-...
> A federal watchdog has identified scores of cases in which the Internal Revenue Service may have targeted liberal-leaning groups for extra scrutiny based on their names or political leanings, a finding that could undermine claims that conservatives were unfairly targeted under President Barack Obama.
This is the kind of scandal the right clings to -- gov't bureaucrats trying to do their job.
"Classic tactic" for the gov't to target conservatives? You need to provide some real evidence or another example that pans out before making those kind of claims.
In case you didn't notice, that was a repeat of the exact words used in the comment that was being responded to. Unless you're planning to call out the initial comment in the same way, since it actually provided no evidence, whether you think it worthwhile or not, perhaps you should consider why out of the two statements, you felt compelled to respond to the one that actually provided some backing.
It's a little disturbing that I had to vouch for gowld since they were flagged and dead. I may not necessarily agree with them, but voting to oblivion and flagging them does not seem the appropriate response.
The government harrasses minorities and progressive groups with this kind of tactic far more than it does white middle class folks, and trying to pretend that playing games with a 501(c)(3) application is somehow "the same" is just laughable.
How did progressive/conservative turn into minorities and "middle class white folks"? I'm in no way sure that progressive groups face more scrutiny than conservative groups, especially given some of the really odd and extreme conservative groups out there. I say this as someone that considers themselves a staunch progressive (if moderate liberal).
Frankly, BOTH are unreasonable and the government should not be engaging in EITHER ONE. I think there is little to be gained by debating which is "worse" -- could we instead agree to cease doing both?
In that context: and individual's right to privacy and to be left alone is much much more important than any organization getting tax exempt status.
SO, no, the two situations are nothing similar in nature or scope.
Being secure in your personal effects is a natural right and protected by the 4th Amendment.
What is classic about it is right wing media (especially in the talk radio era) hyperventilating and manufacturing a scandal where "conservatives" are the victims.
Furthermore individuals/groups claiming tax exempt status where none exists is one of the things that the IRS should be looking for as an agency.
[0]https://www.politico.com/story/2017/10/05/audit-irs-scrutiny...
Here: https://blogs.wsj.com/digits/2014/10/31/judge-rules-suspect-...
Unsure about federal application, actually. We as country need to get our shit together regarding device privacy. You should need a warrant to look at a phone, laptop, whatever, with or without a password. The security of the device should be meaningless.
As for me, I'm grateful that I have the resources to push back should this ever happen to me, jailtime or included. That's a luxury probably very few Americans can realistically afford (seeing as they can just throw you in jail for 48 hours).
I believe the rationale was that they can't ask you to incriminate yourself (give up your passcode), but you don't have to say anything for them to force you to give your fingerprint.
That said, you shouldn't ever rely solely on biometrics. In addition to the legal reason, an adversary could also unlock your phone if you were unconscious / etc using your thumb.
[0] https://arstechnica.com/tech-policy/2017/03/man-jailed-indef...
One case decided that law enforcement can compel you to turn over documents that it knows you have possession of, regardless of where they exist. You're not testifying against yourself; you're turning over evidence.
Another case has decided that they can't compel you to turn over a password so they can search for evidence.
So, it's not incriminating yourself to decrypt something everyone already knows you have. That's kinda weird and concerning, depending on how they proved the hard drive's contents without decrypting it. I mean, if it's just someone saying "I saw it on his computer" then that's problematic in my opinion. Whereas if they have server logs, or logs from a different hard drive of his detailing the contents of the encrypted drive, or something more concrete than hearsay, I don't see an issue.
Edit: I guess the issue is: why do they need the contents of the drive if they can already prove the contents of the drive enough to convict?
The only way to positively know that one has possession of the documents in question is to read them. If they need someone's help to decrypt the documents, then they at best have a very strong suspicion/circumstantial evidence of possession.
Even if they intercepted transmission of the documents in question, they don't know if the documents are still in possession or have been deleted until they've gotten the suspect to cooperate and decrypt all of the suspected documents.
If one had a hidden encrypted partition filled only with copies of the U.S. bill of rights, and the government used sworn testimony of definite knowledge that the hidden partition contained contraband in order to force disclosure of decryption keys, what's the likelihood that a good lawyer could get enough damages out of the government to make it worthwhile to sit in detention for a month or two while things got sorted out?
How about this theoretical situation: I place an encrypted file in a hard drive belonging to someone I dislike, and then frame them circumstantially with the likely possession of contraband data on said hard drive. Since he owns the device, he may be so unlucky as to have the authorities believe he knows how to decrypt the file despite him claiming he has no knowledge of how the file came to be or how to decrypt it. If they will not accept that argument, this seems like a good way to place a political opponent in jail indefinitely by someone with the means to craft such a scenario
However, from a security perspective it would be awful if they could disappear with your device whenever they wanted - that certainly makes me uncomfortable.
If it's optional and I can and will refuse, fine. If it's not,and I'm not attempting to cross a border, they can get stuffed.
For domestic travel, they do not need to examine the data - only the physical device needs to be examined to rule out security risk. They can do that non-intrusively with imaging and chemical analysis technology.
The idea that someone could claim that a limited intrusion into the contents of my communications isn't an intrusion at all is absurd.
Chief Justice would probably be all: "LOL, you did wut? ಠ_ಠ"
Is there any niddling contract law in purchasing plane tickets?
Not likely to work: "We just want to search your house for 30 minutes" or "you can have your document back after we photocopy it, so no warrant needed."
The idea is that they cannot do certain things without a warrant.
I can't exactly go re-write iOS or Android (technically, I suppose I could do the latter) in order to add this feature.
This scenario would be quite a bit more akin to "let me have that locked briefcase you're carrying through security, no need for you to unlock it" and then returning it to you locked after 10 minutes.
Was that a 4th amendment search if they claim that they didn't look through your briefcase?
It's a seizure whether or not they looked through it, and it's a search if they examined—by any means, technical or otherwise—the contents in a way they wouldn't have been practically able to without seizing it, irrespective of whether they opened it (and even more independent of whether they claim they opened it.)
I wonder how long it would take to clone a phone and give back a ringer with some extra software installed. It's not like most people know the serial number of their phone. And if the phone's in a case, then put the ringer in the target phones case, and it has the same look and feel.
Especially if I've got a semi-obscure phone in an unpopular color. That's at the level of a targeted attack against an individual.
The most important characteristic of these devices is that I'm 100% happy to just walk away from them (and there are no easily recovered credentials for any "cloud based" services I use).
If I'm traveling for work (and have equipment that belongs to my employer with me), I am equally happy to walk away from those devices (though I'll also leave the contact info for my company's lawyer).
https://www.cbp.gov/newsroom/national-media-release/cbp-rele...
I suspect they're not installing implants but it would make me nervous all the same about using that device in the future...
leave your phone unlocked, but primed with a goatse booby trap so that the agents get an unpleasant surprise that's totally legal and comes with total deniability -- hey, you just loved goatse so that's why it's on your phone and laptop.
if the agent is offended, perhaps they should have minded their own fucking business.
YOU will get the surprise: if you're a US citizen they cannot deny you entry to the USA but they can make your life miserable by searching and delaying you every single time.
If you're not a US citizen and try to be a "smartass," they have all the power to deny you entry in the USA. No appeals.
A lawsuit for being searched more carefully? Good luck.
Exposing government agents to obscene or indecent content is not going to improve the outlook of your day.
One of the guises state police operate under in America is the "highway patrol"—a force that searches for terrorists and drug trafficking and the like.
And presumably, air travel is a privilege, not a right, just like driving a car is. (Or is it? Taking public transit is a right that can't be denied to someone unless they explicitly break a rule of the system. But airports are private companies...)
So, given that, is there a legal reason that there is no "airway patrol"?
I'm not suggesting they have the powers of random search & seizure that the TSA seems to have, mind you. But should there be state police that are stationed at airports, who search people when they have probable cause?
https://en.wikipedia.org/wiki/Civil_forfeiture_in_the_United...
"In May 2010 a couple was driving from New York to Florida and they were stopped by police because of a cracked windshield. During questioning, the officer decided that $32,000 cash in the van was "probably involved in criminal or drug-related activity", seized it, shared it with federal authorities under equitable sharing. The victim hired a lawyer to get back the seized money who urged settling for half of the seized amount, and after the lawyer's fees, the victim got back only $7,000."
Digging around found a source but I highly doubt its the one that site used. https://www.faa.gov/airports/airport_compliance/privatizatio...
Freedom of movement is a privilege, not a right? What can you possibly be talking about?
Did I miss a memo? The United States (and other common law societies) have a long history of enshrining freedom of movement as a fundamental right.
https://en.wikipedia.org/wiki/Freedom_of_movement_under_Unit...
Also, be reminded that the USA voted in favor of the UDHR, which reads in part:
* a citizen of a state in which that citizen is present has the liberty to travel, reside in, and/or work in any part of the state where one pleases within the limits of respect for the liberty and rights of others
and
* and that a citizen also has the right to leave any country, including his or her own, and to return to his or her country at any time.
Not to mention, just because something is legal doesn't make it right.
I'm sorry, you said something about moving?
Really paying for rides in a car is the last great bastion of free movement (provided you don't get randomly stopped and searched in a checkpoint of some kind) in the U.S. Although, most of those either won't take you on the highway or are prohibitively expensive to do so. Making inter-city and greater travel difficult. But bonus points if you can pay with cash.
I understand, though. There are just so many common sense reasons to restrict free travel. How could one resist?
No it isn't. There are only a few states where it's illegal.
I have amended my original comment to reflect this after doing some research.
What freedom of movement does guarantee, to be clear, is that you're:
1. allowed to own your own plane;
4. allowed to fly said plane over pretty much any American airspace, other than specific little zones cordoned off by the military;
2. allowed to have your own airfield to launch and land your plane;
3. allowed to use the airfield of any American airport to launch/land your plane (at least in an emergency.)
With your own plane—just like with your own car—you have freedom of movement in the US.
It is the government that prevents you from flying on the private commercial airline. Not the airline owner. If the government was preventing people from posting certain messages on private commercial form, that would certainly be a violation of the First Amendment.
The state-run highway patrol is still subject to the 4th amendment (search and seizure.)
If you get pulled over by a LEO - they need consent, probable cause, or a warrant in order to rifle through your belongings.
which they can invent with no problem if they feel like it.
nobody who declines to a search gets away with it; they just call a drug dog to alert and then they can search anyway.
https://en.wikipedia.org/wiki/Federal_Air_Marshal_Service
4,000 law enforcement officers.
But that is separate from what powers we as a society should allow them.
Those last few texts someone sends before committing a terrorist action, could send an extremely strong signal to authorities and possibly prevent a disaster.
If the extra security results in a strange TSA agent getting to enjoy some surprise dick pics, well that's the price of freedom Jerry.
I wouldn't say that someone has 'freedom' if they're being forced to possibly have their body visibly exposed to strangers against their will.
There's a big difference between going, "Hey, the computer put a red square on the left thigh of a generic outline of a human, it suggests we should look there to see if you have anything," and, "Hmm, let's see what Johnny sent Sally yesterday. Oh look, his dick! And this lady who isn't even traveling with him sent him six pictures of her breasts!"
Perhaps not in those terms, but amateur OPSEC failures have sunk more than one criminal enterprise.
[1]http://www.latimes.com/business/la-fi-aclu-tsa-20170207-stor...
The way around this is to define the price property as a reference to the concept of freedom. That way you hold a memory addy to the concept of freedom within the struct and can compile and run your program with impunity.
That's cool, and I respect that. But I am NOT OK with the TSA performing such a search of my devices. (Unless they have a warrant. Then I'm fine with it. It's really that I'm a stickler about this old document called the "Constitution")
Are you willing to stand up for MY right for my (electronic) papers and effects to be secure from unreasonable searches? If not, are there other parts of the Constitution you would be willing to jettison?
(For what it's worth, this is a genuine question not just a complaint. There are parts of the Constitution that I would prefer to change -- just not this particular one.)
Is your partner, who sent you private pictures, ok with it?
Is your company ok with internal emails being read by the TSA?
Does giving access to your accounts on certain apps and websites to the TSA violate the TOS of any of those apps or websites?
Maybe we should take a serious look at that. It could seriously protect tens of thousands!