Amid the recent news of a U.S. citizen being asked to turn over his phone to authorities at a border crossing, Sophia Cope of the Electronic Frontier Foundation has tips on digital civil liberties.
Related, “Attorney representing a student protester detained by federal immigration agents”
When a man in Michigan was heading home on Sunday from a family vacation in the Caribbean, he was stopped in the Detroit Airport. Federal officers, border agents, detained him, interrogated him and pressured him to hand over his cellphone. The man is a U.S. citizen. He’s a civil rights and criminal defense attorney, and among his clients is an activist who has been charged in connection to a pro-Palestinian protest at the University of Michigan.
Archived at https://web.archive.org/web/20250410185452/https://www.npr.org/transcripts/nx-s1-5357455
Tell them to fuck off.
Make sure your phone is already turned off before you go through.
Refuse to let them turn it on.
“I can’t remember my password”
Smile and be polite but make sure they hear the “fuck off nazi” in your tone.
DO NOT CONSENT TO A SEARCH.
I love the spirit of what you’re saying, but per the attorney’s advice in this article, they might seize your phone no matter what you say, password protection with no fingerprint or face scan unlock should ideally keep them out (note that law enforcement usually can take your picture or finger print you without needing a warrant or anything, but they can’t force you to tell them a password), but you will probably never get that device back and you could be detained indefinitely while they try to intimidate you into waiving your 5th amendment silence rights.
So because citizens have an absolute right to reenter the country, they have a bit more leverage to, you know, deny a request or refuse to comply with requests to unlock their phone. But that doesn’t mean that there aren’t going to be consequences. They could be detained for several hours. Their phone could eventually be confiscated. So even U.S. citizens have to think about those potential consequences.
…
[As for lawful permanent residents,] [t]echnically, they also have to be let back into the country, but as we’ve seen in sort of a nonborder contexts, the government and the current administration is pretty willing to question the status of LPRs. And so we always say that, you know, they should be especially kind of mindful and thoughtful about how they comport themselves at the border.
I think your best strategies would be 1) just do not travel to the United States if it can at all be avoided; 2) if you must to travel to the US, don’t bring any electronic devices capable of storing media with you, purchase new ones after you are past the border, securely download what you need, then erase and destroy those devices before leaving; 3) if purchasing throwaway devices isn’t an option, just act as white as you possibly can and just hope you get lucky and they ignore you.
Act as white as possible lol
This 100% is a thing, and it helps. My wife isn’t white but can turn it on and fool almost anyone. It has gotten her out of tickets, sticky situations, rude service industry etc… it’s hilarious to watch.
lol. I am white but I don’t know how to act white. Am I screwed ?
Act like you’re at a classic rock concert instead of punk rock, just turn the basic up to 11.
Turn the basic up to 11 lolllll. You nailed it
You know, you just don’t know you know.
Mind. Blown. Thanks.
Nah your skin color automatically gives you a free pass
If I could only keep my mouth shut
Demand to speak to their manager!
I snorted and blew out snot at this comment. Good job.
Face scan unlock is NOT enough. When crossing the border turn OFF the phone. Don’t just lock it, full off. The security protections from cellibrite attacks are much much much much stronger if it is off
It’s important it’s encrypted as well. Disk Encryption isn’t a default on option typically.
If it’s disk encrypted and the device is powered off, only a valid password (not biometric) will unencrypt it from off.
Edit: and a good device would encrypted it using a hardware module that will only work in that device for that hard drive, so they can’t clone the drive out and try a bunch of easier pins as it’d be missing the hardware piece. Easier pins would only work if done on your phones hardware.
How is it possible to setup disk encryption on smartphone?
Btw on Android you can enable an option, that your phone will be erased and restored to fabric settings, if you enter wrong password/pin 20 times. So its useful too
It’d be a device by device thing. Looks like Pixels do it be default, but I wouldn’t assume all do. It’d be a setting if it’s not default.
If you’re a US citizen they can only hold you for 48 hours without pressing charges. I no longer have faith that limit will be enforced, but it’s there in theory.
Didn’t you hear? Due process is suspended indefinitely. /s (sorta)
Why can they detain and seize phone of US citizens that come back from different country back to the US? I thought they are only allowed to check the phone of foreigners that visit USA.
Because fuck you, that’s why. –The Government
Do you speak Spanish? You might need it in your next destination to communicate with your cellmates.
Don’t do that. Be nice and respectful when you are asserting your rights. Nothing good comes from being an ass about it
Don’t travel to the US.
As an American – please don’t come here until we’ve sorted our shit out. Money is frankly the only thing these morons will listen to.
As someone who makes at least part of their living from tourists, i agree. Avoid America right now. Most foreign tourists travel to Florida, which is the MAGA Nazi Homeland. Stay away, and make them feel it. I’ll ride it out.
Wipe phone, set it up with dummy info like a Gmail account that you’ve previously signed up for random newsletters.add your mom and your dr as contacts, cross border, wipe it again, then restore from cloud.
When I was supporting people in hostile countries they would use a “burner” device. It literally was considered unusable upon return.
There’s a story about how a person brought back a cheap Pdu from an hotel they were staying ant and one day it caught on fire. IT opened it, because power strips are designed to not catch on fire, to find a bug in it.
If it about of your sight for any amount of time it’s probably untrustworthy.
because I’m sometimes too literal, you mean a surveillance bug, not an insect bug?
Sorry yes it was surveillance.
If you are traveling out of the country, leave your real phone at home, and get a burner phone for travel, with no business or old social media on it.
Take pictures on vacation, and if you have to use social media, start new accounts for your trip, and dont post ANYTHING political or controversial, just vacation posts.
Its also important to note that there is a big difference between US border patrol and ICE. You should know who you are interacting with.
Use a pass code. Do not use fingerprint or face ID unlock.
The current law is that you can be compelled to unlock your phone with your face or finger. (Probably should require a search warrant).
You cannot be compelled to say what a pass code or password is. You have the right to remain silent.
If you don’t want to disable biometric auth, familiarize yourself with your phone and see if it has lockdown mode. Apple phones and most modern Android phones support it, using it will require your password / pin for unlocks. Put it into lockdown mode for the flight.
Yes, this is good, however lockdown mode does NOT protect you against forensic extraction of your data, for example from the Cellebrite tool. Your phone has two states, BFU and AFU (before/after first unlock). To maximize your protection against your data being extracted, your phone needs to have not had its first unlock after being powered up. Lockdown mode does nothing here.
So, use lockdown in general if you like, however, when going through customs or in a place where your phone may be confiscated, power it down fully. Don’t unlock it if you power it up, and don’t use biometric fingerprint or face unlock so you’re not forced to unlock it.
Turn off phone before crossing, safest, easiest most resistant
This all assumes you’re a US citizen. While technically it applies to all people, the current administration has had no blowback for consistently ignoring these laws for non-citizens.
Best thing you can do if you absolutely need to take your phone across the border (eg, you need your MFA) is to remove any biometrics, change the password, turn the phone off, and if ordered to enter the password, honestly say that you changed it just before traveling and have now forgotten it.
Personally, I find it easier not to travel to/through the US than to buy a burner or wipe/restore my device (I’m not going to stick my data on cloud backup).
This all assumes you’re a US citizen.
Correct. US citizens have an absolute right to enter the country. So if they want to detain for more than several hours, they have to come up with criminal charges.
Permanent residents theoretically enjoy some constitutional rights at the border, but you all have seen what the current situation is
Non-citizen non-LPRs can simply be refused admission and summarily deported on much flimsier grounds than any of this stuff we’re talking about.
The clear solution is to back up all your data, wipe your phone, and restore it later.
If you’re not a citizen you don’t have any rights. It’s nearly impossible to file a complaint after they deported you. They can just deny you entry (or worse) and even if technically it was illegal there’s nothing you can do about it.
Depends if you are a citizen or not. Limited rights at the border, but you have an absolute right of entry as a citizen, but depending on the situation they may detain you for some hours, or take your phone. Turn off all devices before crossing, citizen or not, use full disk encryption, have backups somewhere else. Assume you will never see your devices again. Be prepared for that.
If you aren’t a citizen, you have even less rights, they can send you back if you fart on their general direction.
… you have an absolute right of entry as a citizen…
You may have the right, but I wouldn’t count on it being upheld.
Trump has already deported US citizens (supposedly by mistake). And he has plans to make it legal.
Yes, that would be unconstitutional, but Trump has ignored the constitution and the courts multiple times already.
PSA on an iPhone, by default, if you press the lock button 5 times in a row, your phone will lock and facial recognition and fingerprint unlock will be disabled.
You’re better off turning the device off entirely. Lockdown mode doesn’t put the device back into a BFU state so you’re still leaving room for an exploit from Cellebrite or Greykey. Not having that first unlock after you turned the device on gives them a shitload of problems.
This, 100%. Lockdown mode is a false sense of safety in all honesty. As MegaUltraChicken (he is legend) is saying, you need to have your phone in a Before First Unlock (BFU) state to have maximum protection of your data (and is also phone model dependent)
Here’s a great link to read more about this and find where your phone falls susceptibility wise.
Good to know!
“I’m a US Citizen, eat my dick”.
Lol you will get this then with that attitude
I mean…it’s more a punishment for you than me…but get the gloves, I guess. I did eat Taco Bell earlier. Fair warning.
Also, to be fair, that’s an appropriate username given your initial response.
He was an amazing physicist and a…complicated…person. But He deserves to be honored with my dick-joke username.
What if you open the phone with a secondary account and allow them to search it without disclosure of the other accounts?
I wouldn’t trust that
Which US citizen did he deport? I’m not aware of that
I think you posted this comment in the wrong thread btw
