Customs Proofing A Laptop

Posted by Martin in Hardware, Security  Tags: , , , , ,

4

Aug



Discovered the article Security guide to customs-proofing your laptop over at Cnet and thought it would be worth sharing it. It does not really add anything new to the discussion and if you have followed it here (Protect your date when travelling) at my website or at others you might already know every point that is mentioned in it.

The article is divided into three threat levels and an introduction with some interesting background information and links. The first threat level mentions data encryption and certain aspects that have to be taken care of. It mentions for instance the fact that it is possible to read the contents of the RAM if the laptop is or has been powered on shortly before entering customs. It also advices to delete all temporary data on the system like browser cache, cookies and so forth.

Lastly it mentions the possibility that spyware could be installed on the computer while it is kept by the federal agents. The next step would be a full encryption of the system which has the advantage that everything is encrypted meaning no one can access it by simply plugging in the laptop’s hard drive into another computer. This could, on the other hand, make border agents suspicious because they might think you are hiding information that they are after.

The last threat level mentions steganophy which means hiding data in other data, for example an important text document in a music track. It also refers to the use of encrypted containers on encrypted partitions. It also mentions electronically sending the data once you reached your destination or storing it on smaller memory cards that are placed in devices that do not look suspicious.

The best solution in my opinion is the secure transfer of data. This ensures that nothing can be found on the laptop that could arouse suspicion It would also mean that the traveler does not have to lie if someone asks questions about the contents of the laptop.

Others suggested sending the data by overnight shipping which still leaves the chance that the package will be intercepted and analysed but has the advantage that the user cannot be questioned for the password of the (hopefully) encrypted drive.


Like such posts? Get updates via RSS NEWS FEED. Love Ghacks? Find out how you can help!

8 Users Commented In This Post

Subscribe To This Post Comment Rss Or TrackBack URL
darkkosmos says:

Why not just take out the hard drive??

Martin says:

Well you have to use the laptop at the destination.

Yogi says:

If this really becomes a problem you will see a rise in laptop rentals.

People will store the necessary data on the net, travel without their laptop and when they arrive they’ll connect and download whatever they need.

This will seriously encourage people to use the cloud and things like Google docs.

I just wonder - what will happen when the U.S. border guard discovers things like email and internet - will they examine every packet that crosses the border? What idiots…

David Bradley says:

I’d have to agree, if I were traveling into the US with my laptop I’d be almost inclined to wipe the whole thing and start afresh once I got stateside with a secure download from one of the online storage systems (or even a hidden folder on a web host)

darkkosmos says:

@martin Just take it out and ship it with some secure service, then pick it up on destination or your hotel

and the encryption method doesn’t work, if you read the the bill the hard drive can be handled by private firms for decryption.

Just Looking says:

I’ve found that using OpenVPN to my home or work PC works fine and solves the problem of airport and hotel wifi. It should also work in this case as well.

darkkosmos:
Using something like TrueCrypt on a laptop will work if you pick a long password plus a few files as the key. Private firms may be given a copy of the drive to decrypt but they won’t get anywhere with it.

Dante says:

I have installed a cascade virus on my laptop - labeling it: young boy being raped.asf. I figure this will peak those nazis’ interest and have a higher chance of them downloading that encrypted file and attempting to run it on their computers. More people should do the same. Who knows, it might shut down that entire nazi computer network.

garbanzo says:

I’ve been reading a lot about this lately, as I frequently travel between the US and Europe. TrueCrypt is good because encrypted files have no signature and cannot be detected - just name it something innocuous like drivers.cab and hide it away. Be sure to use a portable version of TrueCrypt from a thumb drive to reduce the chances of the encrypted package being found.

Some have suggested that if questioned for the password, you can refuse to answer on grounds that you may incriminate yourself. Not sure if this holds, but it seems valid.

I thought about doing some simple renaming of system files from a bootable CD to prevent the machine from starting, but decided against it. If a customs officer can’t do a cursory check, I think that would increase the chances of having the machine confiscated for closer inspection. As would removing the battery, adding a BIOS password, and other methods of preventing a quick check.

Before I travel next, I’ll probably format an old laptop drive and install XP fresh, keep the default settings, put a campaign ad for McCain as my wallpaper, and fill my desktop with shortcuts to things like Window Live and Fox Sports and other things I would never use. I’ll wear sweat pants, Nikes, a football jersey, and a baseball cap with an eagle and a flag on it. I’ll talk really loud with a drawl and proclaim my joy to be back in the good ol’ US.

I’ll then encrypt my ‘real’ drive and put it in my suitcase with my dirty underwear.

Think it will work?

Leave Your Comments Below
Hello, please leave your thought below

Please Note: Each comment will be manually approved by an admin. There is no guarantee that a comment will be posted. Please do not submit the comment multiple times.