Printer Friendly 

How to Secure Your Laptop Before Crossing the Border

By Luigi Benetton

Here’s what you need to know about data searches at he United States border, and how you can protect sensitive data.

August 2009 Update: The U.S. announces revised and sweeping guidelines on border searches of electronic devices: “The U.S. Department of Homeland Security released directives regarding its data search policy on August 27, 2009, which detail what constitutes a lawful search and the process governing devices that are reviewed and/or detained at the border. Solicitor-client material stored on a laptop will not necessarily be exempt from data searches under the guidelines, but it might invoke new procedures that apply to sensitive documents.” View article

Do you regularly travel to the U.S. on business? If you take confidential information of any kind with you, take heed: US policy allows offers of Customs and Border Protection (CBP) to search and confiscate computers, phones, personal digital assistants, cameras, digital music players and other data-storing devices. Operating under the U.S. Policy Regarding Border Search of Information, agents have also downloaded the contents of entire computer hard drives and other storage media for later review. (Note: similar situations occur at the borders of other countries as well.)

This article suggests 10 steps you can take to shield sensitive information, like that protected by solicitor-client privilege, when crossing the border. Each one comes with caveats, the most important of which is that there are no guarantees. You should consult an IT security expert to help you choose the best options for your needs.

1. Be Anonymous

Thousands of travelers cart thousands of devices through America’s borders each day. The CBP has to weigh security concerns with the limited time available for searching.
Many travelers believe the odds will stay in their favour. If you aren’t one of these, read on.

2. Travel with a “Bare” Computer

Be “forensically clean”

The CBP can’t read what a computer doesn’t contain. That’s why certain companies give their employees “forensically clean” computers for travel. These computers contain the operating system, required applications, and little or no data.

Once at their destinations, employees work with data stored on company servers via secure virtual private network (VPN). (Secure connections are a must since, under certain circumstances, U.S. law permits interception of e-mail and remote server connections.)
Employees may download files to their computers, upload the results of their work to company servers and “forensically clean” their computers before traveling again.

Given widespread availability of broadband Internet access throughout the United States, traveling with a clean laptop presents few problems unless particularly large files or problematic Internet access hampers the employee’s ability to access data.

Use software with "Saas"

Following in the footsteps of phenomena such as Google Docs, more companies offer software based on the Internet. All their customers need to access these applications is a standards-compliant web browser.

Conceptually, customers use software as a service (SaaS – on the software developer’s servers) rather than as a product (on a computer’s hard drive). And, importantly, the data resides on the same server as the SaaS application.

This tactic is less secure than total forensic cleanliness for several reasons, not the least of which is your web browser. It records your Internet activity using cookies, history and other data. Delete all these traces of your Internet activity before you board your next flight. (For more information, refer to "Files to Delete” sidebar.)

Saas: One issue to Consider
What if border agents really want your data? If a server (your company’s or a SaaS provider’s) resides within America’s borders, the US Patriot Act enables US government agents to access your data (and impel the SaaS company to keep the breach quiet).

Should the data reside outside US borders but the company head office or chief executives reside within, the data must be turned over upon request or the company/executives may face charges.

3. Turn Off Your Computer, Early

If you must bring data on your computer, turn it off five minutes prior to reaching customs.

While running, computers store unencrypted information in random access memory (RAM). If you walk through customs with a computer in sleep mode, the RAM shows what you were working on.

RAM does not void itself of information until five minutes after the computer has been turned off. So when the “Fasten Seat Belt” sign comes on, turn your computer off.

4. Back Up Your Data

Should border agents confiscate your computer, they won’t stop your ability to work billable hours – as long as you left a copy of your data in a safe place, such as another hard drive or your company’s servers, and you can quickly recover all that data (documents, calendars, e-mail and so forth.)

5. Use a Different User Account to Hold Sensitive Information

Any modern computer can be used by different people, each with their own sets of documents. Users can password-protect their accounts so other users with access to that computer can’t access documents that don’t belong to them.

Privacy application: the traveler can use the computer via a “clean” non-administrative account while in transit and carry sensitive documents in a “safe” account for which the traveler does not know the password. Upon confirmed arrival at the final destination, the colleague who created the “safe” account can send the password to the traveler via secure e-mail.

Meanwhile, all that travelers can do at customs when asked about other accounts is shrug their shoulders. (Remember, all accounts should be encrypted.)

6. Partition and Encrypt Your Entire Hard Drive

Hard drive partitioning, like encryption, is a common IT practice that enables people to use a hard drive as though it were two or more drives. These partitions can be encrypted using different passwords. And some of today’s partitioning tools can hide partitions.
Privacy application: Encryption and partitioning, when combined, allow a traveler to decrypt a partition that contains “safe” data for border agents to inspect. Agents might not know to look for other partitions if the partitioning tool hides them – a tactic known as steganography.

To increase the chances this subterfuge will work, buy a larger hard drive for your laptop, make the “safe” partition the same size as that of the drive sold “standard” with the laptop, and put the rest of the hard drive in other partitions.

Even if you don’t partition, strong encryption of an entire computer hard drive, and electronic data of any sort, is a security best practice and should not raise eyebrows.
Why the entire hard drive? Certain programs can record information outside of encrypted areas without a user’s knowledge.

While strongly recommended, encryption is not foolproof: border agents can simply ask you to type your password. The consequences of denying this request could prove onerous.

7. Protect FireWire Ports

FireWire is a type of data port that allows for faster data transfers than are possible via USB. Certain higher-end Windows-based computers and just about every Mac in existence has FireWire.

The CBP can quickly copy an entire hard drive via FireWire. Macs let their owners block this option by setting an Open Firmware Password. Consult your IT provider for advice on how to protect your FireWire port.

8. Store Data on Small Devices

Camera memory cards and USB memory keys can store huge amounts of data. Since they’re small, you can carry them inconspicuously. Also because they’re small, they are easily lost, and just as easily confiscated by border agents if found, so use strong encryption on these devices as well.
 
The Ironkey is a military-grade USB flash drive that actually self destructs after 10 failed login attempts. (https://www.ironkey.com).

9. Protect Phones and PDAs

Phone records, text messages, emails, documents  – today’s phones, particularly smartphones like RIM’s BlackBerry, Apple’s iPhone and Palm’s Treo carry amazing amounts of information.

But keep the device as “clean” as possible if you think it might be confiscated. Also, enable any password locking and encryption tools, if available.
Another possible solution: certain smartphones can be “wiped clean” remotely when they are reported lost. And every one allows users to synchronize the data on them onto their computers so that they can quickly put the data onto a replacement unit should the need arise.

10. Clean Your Laptop When Returned

Border agents might even return confiscated laptops with a little something extra: spyware that tracks the owner’s computer activity and sends log files back to “Big Brother.”
“Fedware” may be invisible to onboard spyware scanners, so the first thing to do when you get your laptop back is to boot it using an external drive and scan the onboard drive for anything that should not be there.