Encrypt them with spacefiller data and start crossing borders, and then refuse to provide passwords and abandon them for sheer amusement.
Way more fun than recycling old laptops and batteries. And better than planning to travel empty handed, in anticipation of getting ripped off by pesky customs guards.
Long shot, but I'm currently in a position to highly appreciate some new hardware at the moment.
Ultimately I think my answer would be weighing the machine's rareness or unusualness against its power draw, fan noise or other annoyances. More of the former means that I'll accept more of the latter :) but in a worst-case scenario I'll just collect stuff and file it away, for example I was given some Sun V240s a while ago that I hope to be able to fire up when I can rack them in a well-ventilated faraway corner where I can't hear them.
Practically speaking I'm curious where people get rid of i3 based systems and multi-TB HDDs at the moment; I (crazy badly) need a new file server, and (for obscure, fun reasons) saving up for new HDDs is taking quite a few more months (and proving more stressful to my family, sadly) than I'd anticipated.
I just replaced a mirrored pair of USB drives running off a Mac Mini with a NAS from Synology. File server, plus Plex server, plus backup server, all in one. It won't be cheap (even factoring in the Australian duty) but it's something that can be tucked into a closet out of sight.
I've long observed Synology's tech and thought it pretty cool, but in this case I'm trying to consolidate as much as possible onto one machine. I'm trying to find something i3-compatible which has a few PCI slots (ahahaha) - if I can, I can toss one of the old Creative X-Fis I have here in it and get amazing sound straight off the machine with the disks in it, and I can also use some of the other PCI cards I have here too (my pile of junk doesn't have any PCI-E stuff in it yet).
My main focus is just saving up for the HDDs right now. My goal is 5 5TB or 8TB disks so I can use raidz5, which offers 60% storage efficiency and the ability to lose any two disks without issue. The 18-24TB of space is actually needed right now in order to do some serious dedupe across the literally dozens of HDDs I've collected over the years - I've been needing a consolidated file server for about a decade, things have finally snowballed to the point where some of the disks are clicking and I haven't had access to my data for about a year now, heh.
PS - Australia's Internet situation is basically a gigantic laugh (I can only get ADSL2+ - 80KB/s upload :D - where I live), or I'd have pushed everything over to a friend in the States who's letting me borrow his ZFS pool until I get my own set up.
In mid-2001 I had to fly from San Jose to Washington Dulles with a Sun Netra 1120 server. It's 4U and FULL length. Weighed about 60 pounds.
I was late for my flight and the datacenter I retrieved it from had no packaging for it so I just carried it onto the plane - bare.
It fit in the overhead.
You don't get that option. The first thing that happens to everybody who is attempting to enter the US and flagged is that they give you a form to write down all keys and passwords you might have, they will then unlock your phone and attempt to find anything that might be used to bar you from entering.
A common method of confirming a profiled person seems to be using the "I have not done illegal drugs" checkbox on the entry documentation, they will find any drug reference on your devices using the passwords they just discovered. If you answer "yes", you're a criminal and you are barred from entry. If you answer "no" and they find any reference to any recreational drug, no matter the context, you just lied to a federal officer and you are barred from entry.
One rejection is enough to ban you for life from ESTA, so for most people entering the US who don't have a temporary working visa, being profiled is the last time you'll ever be able to enter the united states. A woman I was speaking to was bumped back onto their flight for a 3 year old SMS on her phone where a friend asked if she wanted to come over and smoke a joint.
What? I have lived and worked all over the world, travel regularly to a bunch of countries, and have never once seen this. I could have missed it on some less frequent countries, but certainly it's not on any major country's entry card.
"Have you ever violated any law related to possessing, using or distributing illegal drugs?"
"Do you have a physical or mental disorder; or are you a drug abuser"
It's also on the customs forms for New Zealand, where you're asked along with questions about any drug paraphernalia you might be bringing in. They seem to be much more concerned about fruit than people slipping through with a bong though. Only country I've ever been set upon by fruit sniffing dogs.
Technically still on Irish soil but within the US customs zone, apparently, and I had thus lied on my form when I said I wasn't tranporting fruit or vegetables into the USA.
So we were all pulled in an at that point I figured there was no reason to lie. I discussed all the drugs I'd done previously and they stated there was no way for them to prove I was (or was not) smuggling as trace amounts were found in the bag I admitted to carrying them in for previous ski trips.
I stated it was illegal in my country but had no plans to do it in theirs. I was allowed in on the condition I didn't do illegal drugs in NZ... I accepted their terms and didn't do any gear while I was there.
Quote: ```(b) You had a physical or mental disorder and a history of behavior associated with the disorder that has posed a threat to your property, safety or welfare or that of others and the behavior is likely to recur or lead to other harmful behavior. Answer "No" if: (a) You currently have no physical or mental disorders; or (b) You have or had a physical or mental disorder without associated behavior that may pose or has posed a threat to your property, safety or welfare of that of others; or (c) You currently have a physical or mental disorder with associated behavior, but that behavior has not posed, does not currently pose nor will pose a threat to your property, safety or welfare or that of others; or (d) You had a physical or mental disorder with associated behavior that posed a threat to your property, safety or welfare or that of others, but that behavior is unlikely to recur. ```
I had a banana in my bag. A very ripe one. But the bag was on my shoulder rather than on the floor by my feet so the dog just walked straight past me. There's a hack to remember.
I've been asked to take my bag off my shoulder so the dog could sniff it. I wouldn't recommend this 'hack' — seems too likely to fail.
I've never seen this at JFK or LAX though.
On the note of that form you linked, apparently they send the results live, a friend of mine for a joke checked "yes" to Question 3, and now her visa application is under review.
This prohibits them from barring me from entering, and allow them only to seize the hdd/usb.
1) use FDE with a LUKS-like scheme where the encryption header can be backed up and then removed (making sure you can restore it at your destination somehow).
2) Destroy the header before travel. Carry live media if you need to use the machine while traveling but keep it minimally provisioned (nothing personal on there).
3) Your machine essentially now contains random data (even to you), perhaps except the partition table and/or boot parition(s). Tell the authorities that you "fill your hardisk up with random data before traveling in case of theft."
This is a true statement because: a) without the LUKS header your own data is essentially random, even to you and b) the scheme does protect your data in the event of theft.
Thus you can safely utter it with no bravado.
An even better scheme would use verified boot of some kind so that if the device is confiscated and returned, and its critical to you, you may have some way of proving the boot loader hasn't been tampered with. But I can't speak as to the difficulty of this.
Better yet, tell them your laptop broke while in the airport before boarding the plane, and you are going to buy a new harddisk/get it serviced when you arrive at your final destination. Much more plausible.
It's a felony to make false or deliberately misleading statements to U.S. border agents. Unless your laptop actually broke while in the airport, performing the scheme you described is a felony.
If you removed a key header which is crucial to the operation of your device in the airport, then the question is whether you can legally say, "my laptop broke in the airport," even if it was you who deliberately broke it.
This also covers the case of the question, "Does this device contain personal data?" To which you can truthfully answer, "Yes."
The point, in my original scenario also is not to lie, but to simply avoid being able to provide access under duress.
Why not whipe the disk and enter with a clean system if it's so critical?
wrt giving up the key under extended duress, I was thinking the same thing and aside from simply wiping the disk I can think of another scheme that might serve you well: give the header to a trusted 3rd party who could simply be the one actually controlling access to your data. Your lawyer for example.
Do you have personal data on this device?
and you answer No (when you really do), then you're looking at 5 years in prison under §1001(a)(2). https://en.wikipedia.org/wiki/Making_false_statements
A much better method I have heard is to ship your electronics beforehand, travel with only a burner cellphone, then pick up the electronics after you arrive. Repeat when traveling out of the country.
Sounds like a sure-fire way to get them to harass you more and pay closer attention to yourself.
I still believe there is a way to adjust such an encryption scheme to meet the ideal criteria:
1. you're not lying 2. you can't provide access 3. you're not drawing extra attention to yourself
If you have relevant data, then you simply don't cross borders with a device containing such data (or with a computer at all). This is just common sense. This "plausible deniable encryption at the border" nonsense is just a cryptonerds imagination.
And you just made yourself a suspicious person to be further questioned and searched, while probably committed an offense that could send you to jail.
If the authorities take your device out of your sight, and you're sufficiently paranoid, then discard it and buy fresh hardware.
2. it may not just look random, unless the encryption is done in a way that tries to be plausibly deniable. Not all disk/data encryption methods try to hide their existence.
I mean you can do whatever you want but only the encryption is going to do you any good for actual security. Even if you make it really convincing that the drives are empty, procedure is still going to make them plug it into the copier anyways. I mean, from the article, they're confiscating headphones and power cords - there's no rhyme or reason here except intimidation; the agents don't investigate - someone else does.
Do what you like, but it sounds like hassle you're adding to what is going to happen anyways.
This depends entirely on the context. If you're a high-value target to an intelligence agency, there's a very high probability they would have someone pose as an agent of the TSA or CBP, or that they would have one of those agencies grant them access to your electronics. Someone involved in the publication of leaks or creation of security-related software would count as a high-value target.
they're confiscating headphones and power cords - there's no rhyme or reason here except intimidation
This, too depends on context. For the average person, the purpose is obviously nothing more than harassment. It's not difficult for a flash drive to be concealed inside a USB cable though, and if you're being targeted for a search, it makes sense for them to take everything.
On the other hand, a MicroSD card can be hidden just about anywhere, so if they're not going through all your stuff with a fine-toothed comb, the whole thing is theater.
My objection to the commenter's idea was pretty much that they're going out of their way to create a scenario in which it looks like the drive doesn't contain data, but unless you are a high value target, all that work would likely go unnoticed since you're just getting a standard agent. Even if you didn't, and you had a recently graduated CS savant as the agent, it seems more likely that there would be no investigation to wonder "should I copy this drive or not" - they'd just do it. Or just confiscate the drive, etc. You can make the effort to try to make the drives look blank, but that feels a lot like theatre. It'll maybe fool someone looking to pull data, but if they just do some raw disk dump like with dd or most forensic tools, I don't think it makes much of a difference. It's just planning for a situation that really wouldn't happen.
>It's not difficult for a flash drive to be concealed inside a USB cable though, and if you're being targeted for a search, it makes sense for them to take everything. On the other hand, a MicroSD card can be hidden just about anywhere, so if they're not going through all your stuff with a fine-toothed comb, the whole thing is theater.
I'm not really sure on what the argument is here. Again, I think if a high priority target is really going through, they're not taking the microsd with them. There are far better ways of moving such data, such as a trusted 3rd party who receives the parcel through a series of proxies or a secure transmission, etc. If you are a high value target or in a dangerous profession or project that you feel warrants protection, there are a myriad of better ways of moving your sensitive data across checkpoints. If we wanted to get really fancy, you could have carrier pigeon or a falcon fly it across the border, or feed it to a dog and wait for the micro sd card to be pooped out.
I'm not saying that we shouldn't be wary and consider protections, but it just feels like this line of thinking in tech crowds tends to lead to incredibly specific scenarios that their solution resolves when many much more practical solutions exist. Under the auspices of fun mental exercise, I think it's fine, but when we're considering these as actual solutions to the very real threat of government searches at check points, then it's just adding bad suggestions.
They have threatened to shoot a presidential plane flying over Europe and searched it on the possibility that Snowden might be on board. So yes be aware when you are a person of interest.
I heard USB is a finicky thing, rather hard to implement correctly.
I wonder how many of these copier devices (-- are these dedicated DSM-like units? Probably embedded/outdated Linux then!) were already infected and grep copied contents for relevant data.
In practice, you can be barred from entering the US for effectively any reason at all, unless you are a citizen. At the border you have almost no rights at all.
Not sure about that. After Apple refused to help, the FBI claims to have hacked that iPhone anyway, with a tool developed outside the government.
https://www.theguardian.com/technology/2016/apr/27/fbi-apple...
I think the downvoted parent is relevant in that they mightn't make the effort for a 'normal' person.
Windows Phone user here. I know for a fact the SD card you put in your phone is encrypted and can only be decrypted in the phone itself[1]. I don't know for sure about the internal storage; it's supposed to be encrypted if you use a screen lock on your device but I have no easy way to test that. Regardless, if they can force you to reveal your pin/password you're hosed anyway.
[1] "Can't be decrypted" assumes, of course, that the government wanting to decrypt it doesn't have an agreement with Microsoft to hand over the private key or otherwise provide access. My understanding is that Microsoft's position lately has been "no warrant, no access" but that could just be lip service. In either case, Windows Phone is a dying platform and anyone security conscious enough to worry about border crossings would hopefully have something more inherently secure anyway.
[1] https://blogs.windows.com/windowsexperience/2017/01/12/annou...
http://www.ghacks.net/2010/11/13/windows-phone-locks-in-micr...
http://www.card-data-recovery.com/unlock-windows-phone-7-car...
My personal knowledge starts with 8.1. At least since 8.1 - so practically any relevant phone sold or in use today - the SD card has a hidden encrypted partition which holds apps moved to the card and a public partition for user data (photos, downloads, audio, video etc). This public partition with userdata is not encrypted and can be read at any device.
In the coming W10M update it's possible to encrypt the whole card again, so e.g. photos are protected.
I know that one can be ineligible for an ESTA. For example, if you've made a trip to Iran. However even if ineligible for an ESTA, a person can still go to a US embassy and apply for a regular visa, just like folks in non-ESTA countries.
That'll be the case regardless of whether you've been eligible for ESTAs or had to obtain visas via embassies in the past.
The "banned from ESTA" phrasing had me scratching my head.
Will they wait for it to charge, and THEN inspect it anyway? Or do they let you through.
also, what kind of phone can't be immediately powered up when connected to a charger?
If sufficiently discharged, an iPhone requires about ten to fifteen minutes on a charger to power on. This is true of all models, going back to the original release.
You don't get that option. The
first thing that happens to everybody
who is attempting to enter the US and
flagged is that they give you a form
to write down all keys and passwords
you might have, they will then unlock
your phone and attempt to find anything...
You see, even if I'm forced to write down a password, if that password decrypts a 3TB file filled with shit data that LOOKS like it's still encrypted somehow, and then throws errors on further attempts to decrypt, the goal is achieved.
I have old laptops I'm ready to throw in the garbage. I have old, dying hard drives I can partition with nonsense. If that's all I'm carrying, then border patrol can merrily spin their wheels on it, and it will never contain anything valuable, despite appearances, because it is junk and contains junk by design.
For phones? Well, if all I'm carrying is a 1990's candybar phone with a 4 digit pin, and I "unlock" it for someone, and it shows "NO SERVICE" because I never paid money to activate service on that phone, even though it's the only phone I'm carrying, the goal is achieved.
If I'm carrying a trashy 2008 edition smartphone, and I unlock the bootloader, and reflash with a custom ROM that contains 500 garbage contacts with (555) 555-5555 numbers and John Doe as the name, and then encrypt an SD card with a FAT partition that contains a single 4BG encrypted file that's really just random data, or maybe 9000 files with misleading file names, but all contain junk when decrypted, the goal is achieved.
If I jail break an old iPhone C that I bought refurbished, second-hand for $50 and then I activate it's password protection as the number 1234, but never place a SIM card in the slot, and load it with thounsands of random images from the internet, and tons of fake notes that look like Base64 data, and that's the only phone I'm carrying, the goal is achieved.
Your tangent about drugs is an unrelated digression.
Staging junk devices with garbage data, for the purpose of sacrifice to security theater, is fun, easy, and anyone can do it if they've got the next week or two to pack their bags.
No need to waste their expensive devices AND their time.
Retrieving confiscated devices can ruin time as well.
A device you can safely discard, in lieu of bureacratic form signing, waiting-in-line retrieval queues, is also time saved. Now they've confiscated what amounts to used toilet paper.
Did you read TFA?
It's sort of like "teaching the cops a lesson" by loitering around the local school in an ice cream truck implying something might happen.
Like, wow man. It really makes you think.
It makes me think about illegal search and seizure, and how I guess that only matters for special people. It makes me think that, hey, maybe some inalienable rights are actually kind of alienable, depending on who you decide to alienate, right?
They get paid money to do their jobs. Well wowee! That means they're correct in fucking people up arbitrarily right?
Special person on a blacklist? Fuck 'em up! Don't like the looks of those guys? Fuck 'em up! Hate your job and need to take it out on somebody? Fuck 'em up!
Sure, I get that. But where does the black list come from? Can I vote on who gets listed?
You know, I got some people I'd like to fuck up, myself. Would that be okay?
What if I decide to hire someone to fuck someone else up for me? I got some money to pay them. At that point, they'd be doing their job.
Hmmm. Maybe I should pick a career that let's me fuck people up, just so's I can help write those lists. It'd be my job, after all.
Okay, fine. He was the right bad guy to knock down a peg, so send a message. Sent him a message and he got it. Mission accomplished.
The point still remains: hobbling technical carry-ons like the laptop he has, and cloning handhelds to scrape for metadata intel is still a pathetic strategy which would only slow down a half-retarded script kiddie. It's a weak tactic that isn't going to offer real protection at any border, because that's not how smart people with technical skills approach a border.
If that's anyone's idea for how to interdict hacker operations and learn the details of their network, guess what. Consumer grade computers are likely a mere distraction in this scenario, and it's unlikely that a border agent is going to notice a device or technical object intended to survive a border search.
It's not likely that grabbing these sorts of devices stops the people that care about getting certain devices and data across.
Maybe raising the bar and taking ordinary laptops and handhelds off the table to advertise that it's not childsplay to bring general technology across a border might be another message to send non-professional trouble makers and problem children, such as in this case. Either way, to be honest, I think border patrol is out of their element and beyond their depth in this sphere.
Being a hammer, and approaching all border stops as nails, is a strategy for a century ago, when a pipe with a handle was surely a musket.