Dept. of Homeland Security: Laptops, Phones Can Be Searched Based on Hunches | Hacker News Reader

Dept. of Homeland Security: Laptops, Phones Can Be Searched Based on Hunches

washington.cbslocal.com

18 pointsemeraldd10 comments

We do not believe that this 1986 approach, or a reasonable suspicion requirement in any other form, would improve current policy,”

Well, yeah... the State would clearly prefer a "1984 approach".

We have always been at war with Oceania...

To me, this means that any electronic device you carry across the border should be considered, as much as possible, throw away.

Not that I cross the border all that often.

Or have its contents encrypted with a password that you don't have in your possession.

I'm not sure how wise that would be. Would be somewhat like handcuffing oneself with handcuffs and not having the key.

Official: What is the password? Person: I don't know Official: Why wouldn't you know the password to your own laptop? Either you're lying, or you're definitely up to something nefarious.

Think armored transports where the driver's don't have keys to the storage area.

Person: "I'm just a glorified delivery boy, they don't trust me with the company secrets."

A similar example are couriers who travel handcuffed to a briefcase - having keys for neither.

However, in both these examples there is a very important difference. A thorough strip search would reveal that the person does not in fact have the required/desired keys.

Also, usually such people have superiors who may be contacted in order to get access (if they want to push it that far). I'm not sure if a person could use such a defence if they are a normal traveller or their company does not carry much weight.

There's the rub. Law enforcement can't prove that you have the keys (unless you volunteer them), and that's why being forced to unlock something is a violation of the 5th amendment (since the ability to unlock the data is by itself an admission of possession).

There was a case - I don't recall the specifics - of a guy that was caught with child porn on his computer crossing the Canadian border. The courts compelled him to unlock his encrypted partitions because he had already unlocked them once (when asked to by the border agent) thereby proving that he had access to the keys. If he had never unlocked it in the first place, the fifth would have protected him against being compelled to decrypt the data, since the act of unlocking it would in effect be a coerced admission that the data was his.

The "If you're innocent, you have nothing to hide" game is so old and tired by this point, we should be long past it. Privacy is a guaranteed right, not something that only criminals have a need of. Saying "if you can't unlock it, you must be up to something nefarious" demonizes normal law-abiding people who simply wish to preserve their right to privacy, and erodes the foundation of their rights.

I encrypt my stuff because if my laptop or phone or tablet is stolen or lost or rifled through, only bad things can come from it being accessible to the third party. It's possible that nothing bad would happen, but the options are "Nothing happens, minor bad things happen, major bad things happen." There is absolutely no upside whatsoever. I have company passwords, trade secrets, computer code, SSH keys, and other incredibly valuable things on my laptop. I have my own emails and email sessions, which provide unmitigated access to just about all of my online accounts. Failing to protect that means a huge downside risk with no upside whatsoever. Why wouldn't I?

When I travel, I don't carry the keys with me specifically for the same reason that I encrypt in the first place - in the best case, nothing changes, but in the worst case, being compelled to give up my keys could mean tremendous damage to my employer, my financial security, and my identity. I don't trust other people - especially people who have something to gain by my loss - to play nice or fair or right. It's simply a game of risk mitigation; it's not that I have anything particularly nefarious to hide, simply that I don't want to be able to be put into a position where I'm even able to allow my data to be owned by someone else.

It's the same reason why you use backups and exception handling - you hope for the best, but plan for the worst.

What if you run an international businesss?

Are we even trying to pretend like we care about the constitution anymore or do we really think that "terrorists" must be caught at any price whatsoever?

(serious question)

Reply on news.ycombinator.com