New Zealand travellers refusing digital search now face $5k Customs fine

It was extremely unnerving, they went through all our private pictures, messages, dropbox files, email, notes, dating apps, etc. It ruined the vacation for me, and I've stopped visiting Canada because of how disgusted I felt afterwards. I know Canada is not the only country doing that, so from now on when I cross an international border I wipe my phone (after backing up) and just have a few pictures and messages on there. Incidentally though, that's the only time it's happened to me.

I have found practical success by booting from an encrypted Linux partition that has absolutely nothing relevant on it, with a weak password I can always enter when requested by big guys with guns. Unbeknown to them on the same partition there sits another encrypted volume, at some offset from the outer's partition start. If I fail to enter the correct password for the outer partition, Ubuntu drops into the command line of the initrd, that is equiped with all the tools you need to mount the real, offset partition:

  cryptsetup -o 100000000 create boot /dev/sdc3

It's impossible for any court forensic team, let alone an airport goon, to prove there is actually another partition inside the outer encrypted partition, unless you mount common volumes and cross-contaminate. An important caveat is to properly defragment the outer partition and fiddle with the offset and the size of the inner partition to prevent any conflicts, then avoid writing in the outer partition.

Access to physical phone/laptop is only the first step -- mark my words. Big Brother's bureaucrats are never satiated. Next, we will have demands for passwords and unrestricted access to : email, facebook, photo sharing, hacker news posts, social media, etc.

I see sudden spike in the market for burner phones. ANd a long-term opportunity for a company that can create a "burner" social media profile.

Is this the new "think of the children"? The reasoning seems to be, criminals would rather carry their "digital crime-thingys" across the border saved on their phones, than upload it (encrypted) somewhere on the internet... Or is NZ planning to build a Firewall as well (better than China's)?

I don’t think that’s a valid excuse to search devices though. If anything I think it proves work visas need to be more accessible so people don’t have to lie their way in for a job.

Edit: I also find it funny when people get passionate about their "free" country's national anthems when they're one bad underpaid, undereducated border patrol agent away from not having any rights.

Granted, it's been very "totalitarian" when it comes to immigration for a long time. Not that I don't think they have the right to do this, but when I went to live there with my kiwi girlfriend, I had to give them actual copies of letters she and I sent each other and get a chest X-ray to prove that I'm not just taking advantage of their socialized medicine. So this sort of scrutiny isn't totally out of character for NZ, but the digital search is where it gets intolerable.

If NZ wants to innovate on anything or to have more movies filmed there, they'll have to do it mostly by themselves, or pay ass-loads to import skilled workers.

EDIT: I made a correction to a part that probably gave people the wrong impression. This was not meant to claim wrong of NZ. I love NZ, and they have every right. I only take issue with the digital search.

If they sit down with me and allow me to maintain control of the device while they ask to see recent chats and emails etc I would feel much more comfortable (though don't get me wrong, I still see the whole process as a huge overstep and invasion of privacy).

Photos, logout of Google, clean up downloads, etc.

I don't have anything to hide, however having some random customs dude go into Google Photos which has over a decade of my life documented doesn't seem exactly ideal.

This law isn't too bad as far as a compromise bill goes. The problem is a lack of accountability. Three fixes and I'd be okay with it:

1) Officials must document their reasons for finding a "reasonable suspicion of wrongdoing";

2) Travellers should be able to challenge the search in a court proceeding to occur no later than close of business the next day (traveller must surrender their phone to the court in the interim, but is free to leave the airport after that); and

3) Searchers cannot (a) copy data from the phone while searching, (b) turn off airplane mode or (c) take more than [2] hours to conduct their search.

In the USA at least under third party doctorine that means none of that data is 'private' anymore and can be accessed without a warrant.

I don't know about NZ but I bet it's the same.

This makes me particularly uncomfortable. There should be reasonable grounds.

> Border officials searched roughly 540 electronic devices at New Zealand airports in 2017.

That does seem low, out of what I assume is hundreds of thousands of travelers. With that said, it still doesn't sound reasonable.

What files are they looking for on the device?

I mean, it's not like a terrorist will have a plan_to_place_bomb.doc file on their device, so what's the point? What file could there possibly be on any device that will threaten the security? And how is scanning devices going to prevent you from downloading that file after you go through customs?

But it would be nice if the phone manufacturers made it easier to side step.

Android is close already: it has multiple users. If it allowed you to hide a user (so you had to type in a name, for example), it would be mostly there.

One thing I really wish they would provide is a decent backup service, ie something that allowed you to backup everything on the phone, to an encrypted binary blob. Mainly I want this because having a backup that allows me to restore my data if the phone gets destroyed would help sleep easier at night, but of course it also solves this problem too: backup the phone to a hidden cloud account, factory reset it, restore it on arrival.

Also, this issue raises some more questions:

1) It sounds like they might use a device to scan your hardware automatically, potentially opening the door to copying files for permanent record

2) It is a small step from here to install tracking software on your device (as China is doing in some places)

Just install macOS like you normally do, set it up with a user and some basic data. Then create a new partition in the same container and install what you normally use (or even clone the first one, if that's possible).

Then set the basic one as default boot source, and hold alt on boot to select the other one to get work done.

A light version of the "hidden encrypted volume" solution, without any risk of overwriting your files.

So they've realised they can bring data into a country on a smart phone with a password. Law enforcement will really be screwed once organised crime figures out the other options.

They will see my genitals and the genitals of many other people. Not sure how not going accessing my off-phone backups is supposed to be better.

This is a shame, my partner and I have been spending the last couple months seriously considering new Zealand as a new home, after we tire of SF, specifically because we felt that legally it was going down a better path than the USA.

Where are the protests, free press in arms, academics, ngos and call for sanctions by the 'international community'?

Is anyone going to bomb New Zealand and the US for violation of human rights and restore democracy? So much for 'our values' and the western tradition of 'enlightenment, freedom and democracy'.

Does the Law in NZ have any provisions against self-incrimination? The US has the 5th Amendment, some countries in the Americas signed the American Convention on Human Rights. How does NZ deal with this issue?

Can't it be considered that providing a password to a safe or personal device is akin to being a witness against oneself?

For example, the government/border agency decides that travellers must give up their phones and account passwords. In fact, other governments/agencies see this as leading by example and tag along for the ride.

The justification we hear is 'national security' and, since the first thing we were aware of was the solution itself, we treat it as viable without much scrutiny and proceed to fill in the blanks about what 'national security' means to us: is it terrorism? drug trafficking? illegal immigration? some other hot button topic?

It begs the question and the frustrating thing is; we know the real answer: governments just love authority and surveillance. Yet still, how about some other questions...

What is a better solution to preventing terrorists from hijacking your plane? It would make sense to address the circumstances that actively encourage terrorism, no? That's foreign policy.

Drugs crossing the border? How about checking for the physical presence of them as opposed to forcing people to incriminate themselves for recreational drug usage?

Illegal immigration? That means a lot of things to a lot of people and, if my experience in Canada is anywhere near representative, it might actually be more successful if it wasn't so strict.

In no case does getting unrestricted access to your social media accounts, your collection of nude selfies, entire history of messages going back years, etc. actually aim to tackle the real problems. All the reasoning does is save the government the job of justifying its pathological obsession with your private life.

> "You'd be mad to carry stuff over on your phone.

Of course, intelligent criminals would never have incriminating communications or evidence carried on a device across international borders. What's more, they would know that there is such a law and hence have their devices wiped clean or get devices with minimal information to support whatever cover they're using. Lawmakers and law enforcement must be idiots to imagine that serious crime could be prevented or caught by this measure.

> Privacy Commissioner John Edwards had some influence over the drafting of the legislation and said he was "pretty comfortable" with where the law stood.

This just shows how government appointed officers behave like puppets of the government, and rarely side with common people on big issues (such as mass surveillance).

Similar to DRM, these measures inconvenience the innocent while doing nothing to prevent the bad people from doing bad things. The balance is tilted heavily towards abuse and harassment of the innocent. Being one of the Five Eyes [1] countries, I'm not surprised that New Zealand does this kind of thing.

The lesson is loud and clear: if you're traveling, backup your phone online, wipe it, and then carry it with minimal personal information. Otherwise all your personal communications, including sensitive/intimate photos and private messages, will be taken by border patrol for their personal use.

[1]: https://en.wikipedia.org/wiki/Five_Eyes

That headline reads as if it is from some dystopian cyberpunk novel. We've reached the age where governments are conducting "digital searches" at whim without just cause, gaining access to everything that makes you "you", and claiming it's for your own safety.

Give those pesky 5 eyes poison data of a fictional life via a 2nd phone.

Presumably,refusing to submit my phone to search is an criminal offence, the mind bending part is that I can get out of this by paying money to the government. I can see how a terrorist or drug dealer could be happy with this.

This sucks all round

https://en.wikipedia.org/wiki/Sinking_of_the_Rainbow_Warrior

They were caught by a normal homicide investigation, as almost all murders in New Zealand are. No special terrorism laws, border searches or secret warrants.

This is not just a pointless invasion of privacy in the name of security theatre, it’s a needless waste of time and money.

It's not about "I just want to get high", it's about removing insidious incentives for the destruction of democracy.

Is it permissible to punish somebody for not knowing or for forgetting? And if not, who has the burden of proof? I find that these questions have no good answer. For this reason alone I regard laws that take away the right to remain silent as flawed in principle.

Anyone who has something to hide will either be smart enough to hide it or not bring the device altogether. Really all they're doing is annoying those who are not a threat.

It's like it's a pan five eyes scheduled implementation.

My iPhone isn't logged into any cloud services and the only apps I have installed are Google Maps and Gmail. I don't log into my Apple account and don't have the Dropbox app installed. Much of my data is stored in an S3 bucket. Simply giving an officer my phone means I'm surrendering my Gmail account and local phone data i.e. contacts and reminders. Not terribly worried about that. To really investigate my digital presence they'd need access to my Dropbox, AWS account, personal email etc. Can they request that information despite not having any trace of it on my phone.

How deep do they go?

It's still a huge disaster of a law, though. It's an unnecessary invasion of normal citizen's privacy, while not stopping actual criminals.

When I first read the headline, I thought of something else...

The idea being that before you travel, you upload the encrypted image and wipe the phone, then after passing through customs you restore.

Not for privacy reasons -- but instead because my US-based phone wouldn't work in some of the other countries I'd be in. (At the protocol level, I suppose.)

Assuming it's not prohibitively expensive, why not do the same thing, now?

I agree that this is a troubling policy. But it seems simple to get around, if you were interested in doing so. It's also possible that this suggestion is naive, and feel free to let me know why, if so. =)

I traveled all around Europe, South East Asia and US/Canada only ~5 years ago with all my hard drives (and as such, a copy of all my pictures, documents, but some movies and music too), and most of the time, the fact that I carried 4 or 5 2.5"hard drives on me was just considered funny, once I explained that it was hard drives with work & personal stuff on it.

Also, the device is in "plane mode", but they will read your facebook password from lastpass and off they go on _their_ desktop computer -- looking at your FB profile, history, etc...

I accept that argument in principle, but practically, since it’s so easy to keep any illegal materials on the internet and retrieve them post-security, how does digital search still make sense?

Bad people are going to find ways to find ways to take advantage of a system in place, but at least we can try to make it a safe for those innocent.

I give pause when pondering international business travel. I can’t very well wipe my laptop, nor could I hand it over given what’s on it. Put everything on a VM and move it off the device for border crossings?

So if it can be got across the border digitally, why would they put it on their phone that can be seized and searched?

The efficacy of this law wrt. the new challenges we face is at best questionable.

Of course they don’t have to tell you why they want to look at your phone or what they’re doing with the stuff they’ve copied off it.

It’s basically a pant sniffers charter.

As the comments above can attest to, there's multiple ways of circumventing these searches. And we've given it what, 5 minutes of thought? Imagine what you could come up with if you actually had something to hide.

You fly through security, both on land and in airports, and you even get expedited through domestic security screening. It has made flying 10x better for me.

Is there no collective legal recourse for us?

Now when the rent-a-cop futzes with my phone, it's a GDPR violation. But am I to blame or the border agent?

the restriction and surveillance of their citizens within their country are far, far more troubling to me.

If someone has access to your phone they can always find something.

I wonder if there's a technological solution for this other than wiping the phone clear?

Taking a laptop means running tails or having a second partition, something simple/windows to boot up. Customs just wants to see a desktop im guessing.

as for file searches on the phone, its a bit more complicated...

1. run syncthing on your phone, send your data to the cloud.

2. wipe/factory reset the phone. now you're ready for that inspection.

3. restore/load once on the ground and in your hotel.

With all that what I'd like to see is a simple interface to create arbitrary numbers of custom Views with associated triggers. The default one would be as we have it now: everything you load is visible at all times after unlock. But then you could create a new one, and select which apps (and in turn associated data in that app silo) appear and which preferences are accessible, then have a "This view will be made active when..." with nice UI for various key conditionals (time, geography, speed, network connection, biometrics, and/or password). It'd then be easy to ensure that while traveling between locations only maps, ride hailing and airline apps would be available for example. If anyone stole the device, or for that matter compelled it in any other way, none of my financials or private info would be available. I couldn't even be compelled to do it at that location, it'd be genuinely out of my control, backed by the same hardware crypto system providing standard FDE. This isn't even about government fully or even in large part, in dangerous parts of the world just as modern device net locks reduced the value of stealing a device a spread of "tourists and the like literally cannot be made to transfer money or the like on the street" could reduce the incentives for certain crime.

And again it'd be a very grokable common sense feature for the attention issue too. These days information overload and things trying to grab for some of our mindshare is a huge source of stress. I'd love if my devices, rather then always being a matter of adding on, started being able to actively help me subtract instead. I could compartmentalize work apps to only even "exist" away from home, no temptation or notifications even show up. And vice versa, entertainment distractions vanish as I enter certain locations. "Willpower" is something of a limited resource too and in practice often comes down to essentially planning ahead to avoid temptations in the first place, not going to the grocery store when starving for example. Our digital devices should be, at our individual direction, automatically helping us as humans. I think that'd be a valuable next step anyway, but the fact that vastly more powerful and user friendly coercion code type systems could be made widespread too would also be helpful in taking back some of the privacy digital can also take away.

And what are they going to look for?

do they still give you trouble, like over why you dont travel with your regular phone?

Evidently, severe brain damage is no hindrance to securing a commissioner's appointment in New Zealand.

Guy was reading her Tinder messages and accusing her of being a prostitute. He brought up some saucy messages and would say things like “girls don’t do this kind of stuff for free...” Finally handed her back her phone with a comment like “well, maybe you are a good girl ;)”

He was fixated on some message where she commented how much a meal might cost at some restaurant and used that as an excuse to ask personal questions about sex and prostitution.

I hope this sort of malarkey doesn't become the norm. This seems rife for abuse. If you have good enough information to demand to rifle though someone's phone or computer, you have good enough information for a damn warrant.