Comment by schoen

You can offer the I don't travel with my real phone because it got stolen a bunch of times excuse.

The point is even if they become suspicious all they can do is seize the burner ask you a bunch of questions etc. search you, etc they can't get access to your data. You can't get in real trouble, just majorly inconvenienced.

> not really practical for most people

Evaluate your threat model and the chance that a wipe and reinstall of the OS will be insufficient protection.

If you were targeted, you may have some tough choices. Might as well think about them ahead of time.

Coercion was the reason from start, it's explained in the article.

"A motion filed by his defense argues the interrogation focused on child sexual abuse material as a pretext for investigating his connections to the protest movement."

So the message was simple: don't protest and you will be not harassed.

Or anything else you can't easily transfer. I can't help but point at passkeys in particular (or 2FA in general).

A variant of this is the well-known scene from a previous century's movie involving extracting an eye to bypass retinal scanner.

Like when fingerprint readers were added to car doors in the 90s, and carjackers started cutting fingers off to get away...

Six of the eleven times...

Crazy.

What city was this, if you don't mind me asking?

That is insane. Where do you live?

Joburg?

Brazil maybe?

No, you're not.

And idk how people don't understand how "politeness" gets weaponized.

This video is an example

https://youtu.be/amSIcL3V5C4?is=hmlOx2t7dHg5j-lJ

Here, the only way this guy could've had a "good attitude" is if he had let the lady do whatever she wants with his service dog. This behavior is very common in situations where people feel entitled to something, but know the counterparty has the absolute right to refuse to cooperate. No matter how politely that information is conveyed, it's "rude" because they're being denied something they want.

The police don't like my attitude when I firmly say "no, sorry, I won't be unlocking my phone. I will only do what I am legally required to do."

People have a hard time understanding this because they are under the impression that they know how to be polite because they do what they think is polite. They are unaware that politeness is subjective and slippery and that people can and do use it to manipulate others into doing things they're uncomfortable with.

[Am in agreement with being conflicted about this advice]

In a normal functioning society with law enforcement that is actually accountable to it's citizens, yes - polite pushback will likely have no horrible consequences.

In a country that is either already in the depths of fascism/authoritarianism - or rapidly heading there, fighting for rights is seen as a "red flag".

See also: "On Tyranny" (Timothy Snyder) and "Do Not Obey in Advance".

Politeness is the correct behavior on most walks of social life, but on this case it's a bit like the "turn the other cheek" approach, but in this case, it's turn the other butt-cheek because you're being effed in the A.

Also, you do have rights, but don't seem to really care a lot about them since, in the face of unlawful and oppressive demands by overreaching authorities, your suggestion is to be courteous with the oppressors for some reason.

"Land of the free, home of the brave"

They can just ask you to unlock it for them.

I will ask this here again:

At what point did the German people find it morally acceptable to start killing Nazis?

At what point will the US stop accepting the boot and act to remove the tyranny stamping on our collective face?

> the issue is that when a phone is unlocked, they can just plug in a USB device and scrape everything off it

That's useless if the backup account and the main account use different keys for the home partition.

VeraCrypt (used to?) have this. It was called a hidden volume. One volume, but two keys, two passwords, and two different containers full of data. Technically, the second volume is written into the partition "from the back" using key 2, while the first volume is written "from the front" using key 1.

Fun fact, there's no protection against writing over data in the other volume if volume 1 + volume 2 exceed the size of the partition - and there can't be, otherwise the volume wouldn't be hidden.

For now the courts in the US have set a different barrier for automated extraction and hand searches. For now.

Why does the USB port need to even work anyways? It could just be designed to look like a USB port but fry whatever expensive and proprietary phone hacking device they bought from some scuzzy Israeli ‘security’ company when it’s plugged in.

Right, these goons are hand searching through phones specifically to find something, anything, they can use to make your life suck and detain you further.

A pin that boots into a dummy account, full of benign messages, photos, innocent web browsing, etc. is going to get you a pass. They'll flip through everything and get bored after a minute of not finding anything.

Far less likely to aggravate them than wiping your phone

Its such a shame Android's backup/restore is such a mess, even more so in GrapheneOS. I remember the era before Google and manufacturs started cracking down on bootloaders and custom ROMs - I used an app that could do effective, actually full backup and restore in single click.

Good times.

It's hard to justify an iPhone Pro Max as a "cheap travel phone" though so you might actually need to buy a cheap travel phone.

Nobody forgot a word. "Some" is nowhere near an appropriate word to use in that sentence. All Americans share the blame in what is happening right now. All.

> [most]

Your word memory is faulty as well

I hope to meet one some day.

Security concerns you need to think about when visiting the US are absolutely no less than those when visiting China these days. Treat it like a totalitarian dictatorship with more technological means.

I wouldn't say you are overreacting at all. I know someone who was detained for months on US soil after a phone search where the only "evidence" against him they found is illegal content sent by someone else to him on a group chat he doesn't even check. Had to get a lawyer and spend time in prison just waiting to be deported back.

My dad's eighty+ years old, he was born in the States, though he did give up his citizenship. He brings a "fake" phone when visiting family, he's been doing so for years.

Me; I just change all my tabs and recent history to slightly kinky porn and truth social. They do look hard, but they don't look hard.

The US is first world on a technicality: the first world is defined as countries that were allied with the US during the cold war. If not for that, it'd be classified as developing.

It's common to mix up developing/developed and third/first world because they were largely aligned during the cold war. But there is one first-world developing country.

I used to love visiting the US. I have many friends there, and I really enjoy staying in places like Seattle and SF. But I haven't gone there since Trump 1.

That said, I think protecting your privacy is a good idea in general.

Yes, I will probably never go back to the US. But I find it sad that my kids for example, will have to think twice before visiting, if they do.

> for visiting a supposed first world country.

... which by now is a banana republic of the worst kind. Can you interact sanely with an insane counterpart? Avoiding to visit would be my recommendation too.

Just out of curiosity, like what country would you not have to worry about this in?

The US is quite transparent about these rules, and certainly other countries are not necessarily searching peoples phones as publicly

But anytime I transit a country USA or any thing I fully expect to have zero rights

You need it to look set up enough to do critical communication / tourist activities. It should look like you had to reinstall your OS right before your trip, and only had time to get the basics on there. Most people will prioritize communications, maps, and payments over anything else, with video/music/books/podcasts following that, and signing into the vast universe of social apps later if ever.

You're right for non-citizens.

For citizens, no one needs to believe it. You give them your empty phone and they can't download your phone contents and contacts.

The point is not what they believe, but how to avoid both breaking the law and not giving up your data, isn't it?

As long as that's legal, what they believe doesn't matter.

You are not legally obliged to keep your data on your devices all the time.

What do you mean?

There's a difference between polite pushback and being straight up disrespectful. It shouldn't matter as the cops shouldn't abuse their power and shouldn't attack people, but we live in the real world. The judge probably didn't want to have to deal with the potential future mess if op didn't learn their lesson and got beat up by a cop.

Yeah, but go tell that to the judge who’s just about to slap you with a sentence.

Unless you want to fight that all the way up the judicial food chain

There's a huge difference between misusing their power and not having perfect understanding of what they're allowed and not allowed to do.

I'm sure there are scenarios where the cop can confiscate the surfboard and the car. The distinction is probably somewhat vague even for highly educated lawyers, and cops cannot expected to be that.

He should have stood up for his rights, sure, but laughing in the cop's face and telling them they're full of shit is disrespectful, and at least where I live is a misdemeanor even if the original case is wrong.

To be fair to the judge we all had broken an ordinance about surfing in a certain area. It was enacted to protect swimmers in the summer. With that said, there was a storm with wind, rain, and currents that had pushed us into the area. Obviously there were also no swimmers out.

The ordinance was removed a few years later. This cop was also known to hate surfers. All the small beach town BS you hear about.

at some point you just take your lumps.

Most people don’t have boundless time or energy and just want things to go away.

… ironically this fact is used a lot in gaining confessions by police.

That's interesting. I don't even know most of my passwords (thanks to password managers).

With self-hosting, it's possible to easily bootstrap a clean phone with all your data and passwords from scratch, without relying on any third-party cloud services. The only thing you need to bring across the border is your brain (which contains the most basic information on how to set up your password manager) and maybe some kind of 2FA generator. Your password manager then contains all the other information you need to get everything running.

I don't think it ever makes sense to transport actual data across borders if you care about governments gaining access to it.

You can simply use an Apple account for your primary device and a Google account for your burner (or vice versa). Or set up a secondary Apple or Google account. Or use a device/OS that doesn’t require one of these accounts!

> UK visa requires a smartphone

I don't think this is accurate.

Well, assume your phone number is public knowledge.

"Wiping is obviously extremely suspicious and asking for trouble"

It's sad this is the default view. It's his device, his data, his life on that phone. If he had wiped the phone before the interrogation it wouldn't be a problem. How long before? A second before? A week before? But wiping the data a minute later is suddenly asking for trouble.

We noted in the border search guide that lying to the agents in response to their questions is potentially a crime in its own right (even if it's not done in order to hide anything illegal). We thought that this made hidden volumes quite tricky, particularly if one's intent was to pretend to comply with a question or request while actually not complying.

Problem is „are you sure you marked for deletion all the correct things” because you could have already deleted it before traveling or moved to other device you don’t travel with.

Selection on border control might be arbitrary, they can hold you or send you back over a photo or something you wouldn’t think should be a problem.

Ideally you would like to have all wiped just in case but then you really stand out…

That's a more risky strategy. What if you added new files since the last time you updated the deletion profile? It's also technically more challenging. You have to think about what might be in RAM, caches, backups, etc.

The good thing about a total wipe is that it's very easy to implement, and it's hard for it to go wrong. You just encrypt the whole drive and, when you want to wipe it, erase the key.

Deleted stuff can easily be recovered. I think the full clean will remove the encryption keys hence making it unrecoverable.

Yes, this also has the advantage of speed perhaps. I can see, deleting specific apps (and their data) as thing #1, and thing #2 would be certain directories. Of course, the problem is, are icons going to be vanishing off the home screen, when the agent is looking at it? Or will the unlock -> screen coming on, be super slow?

Of course the problem there is, many people have an app store installed, and app stores have histories. And logs. And "what you used to have installed" is so easily found under Google Play, for example.

As someone else said in this thread, the law isn't code. It's not if-then statement based. It's also predicated upon intent in many cases. What actions did a person take, and why, when told to (for example) unlock their phone.

The problem here is that if you are asked to unlock your phone, any action you take to thwart that request by "trickery" to get data deleted, could be construed as 'deleting evidence'. So while some methods might make it more difficult for the border agent to realise "something happened", if they're suspicious still, then you're still in hot water.

In the eyes of the law, the court, and likely the jury, you've done a sneaky thing to thwart evidence collection.

The only safe method is a full wipe prior to travel. In this manner, you're not deleting evidence when told to hand it over. It's an entirely different bar. They can be cruel about it, and take your phone for a few months, but you're not going to be in legal hot water.

In as no one will see the phone is wiped until you are compelled to unlock it, there's no greater change of the phone being seized. You're already being investigated. Just be blunt, say "Whenever I travel, I just wipe it", and that's that.

This is why it's a shame that GrapheneOS has no viable backup solution. Its build in method is unreliable, and doesn't work very well, and is gitchy, it's a very well known problem.

And Android and ADB sometimes have issues with large backups of directories, and so you have to manage that with tar + stream and other business, but at least working around that is easy.

But if you could backup individual apps and all their data, you could uninstall all your privacy laden stuff, cross the border, and reinstall in minutes.

That's the true, legal way to travel safely. Especially if the app removal resulted in a 'shred' of the data files instead of delete.

If anyone has ever struggled with large data backup/restore, here's the only real method I've found for copying large swaths of files from/to via adb:

  adb exec-out 'tar --dereference --create /storage/emulated/0/dir/  2>/sdcard/backup-errors.txt' |dd of=/tmp/backup-$(date +%Y%m%d).tar && adb shell cat /sdcard/backup-errors.txt

and to restore

  dd if=backup-20250309.tar | \
  adb exec-in 'cd /storage/emulated/0/tempdir; tar xpvf -  2>/sdcard/restore-errors.txt' && \
  adb shell cat /sdcard/restore-errors.txt

Or something similar.

I'm European and I know plenty, albeit the minority of those I know that went to the US, so I wonder how reliable are CBP stats.

Maybe my anecdotal experience is influenced by me being in IT, but still.

But why would that be legal? The device is owned by the individual. No judge signed any warrant search for the device. I can do what I want with my device - that is a basic right of property. Imagine if border guards seize money willy-nilly.

This part is pretty new. I wonder if my former colleagues have done any FOIA work looking into how travelers' disclosed social media accounts have been reviewed or analyzed!

You also have to provide every single email account you have used in the last ten years, all of them, forgetting to declare one is an offense.

There's no chances I can remember them all, especially as I've been contracting and get a new email every 3-4 months or so.

It's reasonable for a country to want to know if you're likely to abuse your visa.

Eg your socials might show you are a professional paid speaker at conferences. If you applied for a tourist visa that would be reasonable to flag you and ask you if you have paid gigs on the wrong visa.

Europe will also ask the same questions for foreigners. If you're a young woman travelling on your own you can expect questions to challenge if you might be earning money as a nanny on a visitor visa. Checking their phone messages to see if they've been making arrangements to this effect is a very straightforward way to determine intent.

Not everything is an evil conspiracy.

And they would have taken his phone, pulled it apart and cloned the memory to get the data. And in a month or three, returned his phone to him in some condition which may or may not include "working".

I've done that and they held me for about a day, strip and cavity searched me, imprisoned me, "diesel therapy" me across the state while taking me to multiple private ER claiming there were drugs up my ass to run up hospital bills in my name. They've also threatened to revoke my passport or deny me entry to the country (both failed).

They also would not allow me access to a lawyer during questioning or imprisonment.

Another woman was at the same port of entry, was raped to "check for drugs", sued, and lost. Apparently raping is a legal way to search for drugs (that were not there).

Maybe change your location then :P