I'm hoping that manufactures will start building a plausible deniability user profile you can log into while leaving your actual profile encrypted, appearing to be slack space.
This kind of thuggery seems to be getting more common.
This kind of thuggery seems to be getting more common.
Lying in that situation would seem like a very bad idea (I'm not a US national) - I've had a few uncomfortable experiences over the years entering the US and I certainly wouldn't want to do anything that would give cause to escalate things on their side.
Doesn't sound that paranoid to me: wasn't there talk already a year ago about trying to force people to log into social media accounts when crossing the border?
Fact is: I don't do Facebook, nor any other Facebook product, so I'm really not able to hand over any such credentials.
With TSA/Customs you need to be truthful. If you don't have an account say so. If you have one and say you don't that's a felony.
There was a case recently of a NASA scientist being hassled at the border for his phone. He initially refused on the basis that handing it over would compromise his obligations to his employer. It did not work.
https://www.theverge.com/2017/2/12/14583124/nasa-sidd-bikkan...
Are allowed to? Maybe, maybe not. Will do anyway? Probably yes.
Once the agent has your password and takes the device into their back room for an hour, you have to assume that all data has been offloaded and the device has had an undetectable rootkit added.
This gentleman's expertise is in security and encryption and now he works for Apple, a company that makes products that the US government can't always crack. He was clearly targeted in his encounter because of his current position, based on the questions they were asking. Surreptitious access to his devices is highly desirable to US intelligence services.
Any device that you lose physical control of during these encounters must be presumed to be compromised and should be physically destroyed afterwards.
Seems unwise to destroy evidence. Find the rootkit, or have your employer or security researcher do so, prove it's existence, and sue the Government.
But yes, definitely get a new laptop.
It's way easier and less legally ambiguous to make people THINK you are rooting their devices than to actually do it and leave actual evidence to be found. They could even be looking for OTHER rootkits instead of installing them.
I suspect there's a lot of availability bias going on here as well - how many travelers go through the US per year versus how many of them are famous ex-CTOs that get reposted on HN?
He wasn't FORCED to unlock his computer, he was just detained for three hours because he wasn't. Adding technical restrictions won't stop that.
The password to this freshly wiped device is "Orwell1984". Feel free to have a look, but all you'll find is an app called "Secure Erase Free Space". This SD card I'm carrying separately? No, you can't have the password to that. Yes, I know, you can hold it indefinitely.
I have a hard time believing that an audience that finds buying a car stressful (as is often stated in Tesla threads) is going to demonstrate assertiveness to a real authority...
But that's why relying on a trusted external party, like the company you work for, to control your access to your data, is a much more effective strategy. TSA/Chinese police can threaten and bully you, but not your co-worker in a different country following company policy.
There's also a good argument to be made that the search is illegal, it's important that everyone stand up for that, even if its stressful.
https://www.eff.org/deeplinks/2017/04/bill-rights-border-fou...
You don't have to specify that you consider customs agents thieves, that's just up to you if you wanna put that lil' spin on it.
(But for real, this seems to me to be a bulletproof way to both make sure TSA can't access data on your device AND make sure you get pulled aside "randomly" for an extra-long questioning session.)
Deniable encryption can actually be very dangerous for people who are detained in places where torture is used. Even if you unlock your device, law enforcement have no proof that you have unlocked your real profile[0]. This is relevant to countries where people can be detained for not unlocking their devices, like Australia.
[0]: https://en.wikipedia.org/wiki/Deniable_encryption#Drawbacks
Aside: don't use TrueCrypt anymore for other reasons.
Also: https://xkcd.com/538/
Common mix up, but the agency in question is CBP, not TSA.