This post outlines why and how travelers with laptops, especially business travelers, are put at risk by border police searches of their computers.
I also attempt to present some techniques as to how this risk can be avoided, or at least mitigated.
The United States Transportation Security Agency, and the United Kingdom’s Regulation of Investigatory Powers Act (RIPA) have one thing in common — they expose travelers carrying sensitive information to risk. A few relevant links on the subject:
Security researcher Moxie Marlinspike profiled and detained, equipment confiscated (later returned)
Wikileaks volunteer and developer David Appelbaum detained, equipment confiscated (some of it returned)
ACLU mounts lawsuit against baseless border laptop searches (a warrant is required since 2009)
UK man jailed under RIPA for refusing to hand over encryption keys to laptop
The USA and UK are by far not the only countries where user laptop or portable device data is put in danger. In other nations, individuals may encounter draconian police laws (e.g. in totalitarian states) or corruption, and some other developed, stable, democratic countries occasionally make legal provision for confiscation of devices or investigation of data. For example, in 2006, Brazilian federal police raided the offices of Credit Suisse, as well as the homes of several senior bankers. What kind of access this gave them to business-critical data is open to speculation.
A Hypothetical Situation At the Border
The scenario that most concerns us is as thus:
A user (let’s say a busy manager) boards a flight. He is on a way to a business meeting, to negotiate a merger. On the flight, he relaxes and opens his laptop to get a bit of work done, editing his presentation for the first meeting, then becoming a bit distracted and looking over pictures of his little daughter playing in a kiddie pool. The manager is annoyed at his chatty neighbor trying to crane his neck to get a look at his monitor, but his privacy screen blocks prying eyes. 30 minutes before landing, he closes his laptop lid and opens a paperback.
Upon entering customs, an official looks at his passport and picks up the phone. He mumbles something about “additional screening”. Two uniformed officers appear and very politely ask the confused executive to please follow them. He is escorted to a windowless room, whose walls are lined with posters extolling the mission and professionalism of the bordeabr patrol, and warning against importation of illegal substances. The manager is asked about his identity, and prompted to empty his pockets and open his bag on a table; while an inspector rifles efficiently through his carry-on, a second official looks on. The manager’s questions and protestations are met with bland reassurances about “standard protocol”.
The first inspector finds the laptop, and walks out the door with it. As the manager moves to stop him, the second inspector scowls and blocks his way. Within a minute, two more officials enter, and begin talking about a suspicion of child pornography, and what serious consequences it harbors. They mention that a fellow passenger reported having seen “suspicious” images on the laptop, and “encourage” the manager to cooperate, bringing up vague hints of terrible punishments, no-fly lists, and harassment. He is presented with a form and a pen, and asked to write down his laptop screen lock password. The manager looks at his watch — he has not slept much and needs a shave; his limousine charter has probably left by now. His requests to make a phone call are politely but firmly denied.
Periodically, someone re-enters the room to ask about another password to an application (email, etc.) An investigator inquires as to the password of his PGP-encrypted virtual disk. The man’s protests are met with stern reminders that he must cooperate. The executive has heard that it might be a good idea to have a lawyer in this country, but as a foreigner, he does not know how to go about it, and must be present at his meeting tomorrow. In any case, he could not contact an attorney. He does not think of asking to leave. After four hours of this, punctuated by short interviews asking him to clarify, his laptop and phone are returned to him and he is allowed to leave.
What now?
Do we know that the data was removed upon failure to show any child pornography, incitement to money laundering, or terrorist literature (insofar as any of the above are not protected by free speech anyway)? When the above user is the CEO of a multibillion dollar corporation, or his fully authorized deputy, are we sure that no information was passed on to a national champion or other competing firm?
However, the United States and UK are the two largest, most economically significant liberal democracies to give their police and border protection enough leeway in terms of data interception and confiscation to constitute a real danger to anyone carrying sensitive data (or just those who feel that what’s on their laptop is nobody’s business; whether those contents are legal or not is beyond the scope of this article.)
Full disclosure: I am vehemently against search and seizure laws that do not require a warrant. I oppose border inspections of personal digital data unless they are extremely tightly controlled, as I believe laptops are very personal items. It is my opinion that law enforcement (particularly border control) authorities should be held to a very high standard, so they can be trusted to maintain the high professional standards they claim to adhere to, to safeguard data and privacy, and to consistently respect rules of evidence. Nonetheless, I suspect that border patrol and law enforcement agencies in much of the world have at least at some point acted as agents of industrial espionage. I have strong ideological convictions in this regard, and do not hide these.
My objections are not so much addressed at places like China or Saudi Arabia, which openly engage in totalitarian, intrusive aspects of data analysis and censorship (and possibly theft), or Venezuela or Indonesia, where corruption and arbitrary measures can be expected. You know what expects you when you visit an authoritarian or corrupt country.
These are my personal opinions. I will be happy to provide my reasoning elsewhere. This post, however, is no more than a discussion of technical and procedural controls that allow individuals and companies to reduce their exposure from mobile device seizure and data analysis. For the purposes of those who claim that “those who have nothing to hide won’t mind security measures”, I say that
- no security is engendered by this. It is nonsense “risk management” or investigatory technique
- it sets a very dangerous precedent in any society making even a small pretense as to individual liberty and freedom from arbitrary search and seizure, and questions the idea of the fundamental human right to travel
- it puts a burden on host countries, insofar as illusory, ineffective, intrusive security mechanisms discourage travelers from visiting and bringing money and business, and
- from now on, you will leave the door to your toilet open every time you go to take a dump
For the purposes of this article, we do not care what kind of data you have. We will assume that you want to protect it, and that users are sort-of-but-not-highly technically versed. Furthermore, I cannot address mobile phones, embedded tablet PCs (iPads e.g.) or PDAs, because I am unfamiliar with security mechanisms supported by various operating systems (IOS, Android, BlackBerry OS), so we’ll focus on generic mechanisms for laptop operating systems, with a few concrete examples.
Hardware Exploits, Rootkits, and Keyloggers
First of all, the as soon as someone has unsupervised physical access to your device, it is possible to implant keylogging hardware. Although the supposed Dell laptop keystroke logger was a hoax, small hardware keyloggers are a fairly mature technology. Interrupt detection won’t work, as the keylogger isn’t being installed stealthily (remember, the device is out of your possession / sight, and no attempt at stealth is being made. If it’s rebooted, it’s rebooted.) We assume the device is being carried, rather than checked in luggage, a stupid thing to do in any case — as such, the whole problem with border patrol or police temporary confiscation of laptops is that it is done in the open.
Even without manipulation of hardware, the hypervisor rootkit model presented by Joanna Rutkowska (“Blue Pill” — more here) would allow persistent access to even an otherwise “secure” laptop operating system, with full bypass of its security capabilities (e.g. by intercepting monitor signals or keystrokes). I am unfamiliar with any functioning examples of such an exploit, but that does not make the concept any less valid or dangerous, or mean that it does not exist.
If there is any suspicion of the above, there’s not much point to reading the rest of this article. The instant that something leaves your possession and sight, it can be assumed compromised. The only mitigating factors are
- hardware keyloggers cost money. You may not be worthwhile (does not necessarily apply to, say, a senior executive)
- installation takes at least a bit of time. I do not know whether a rootkit could be slipped onto a drive without imaging the entire system
- there is a tiny risk of detection if done inexpertly — if you are ultra-paranoid and have opened up your device, noting down component serial numbers, you may be able to detect new hardware
- certain types of hardware require user interaction to get around drive-level encryption; cracking these is not feasible in a short period of time. Then again, someone may just demand a user’s boot password under threat of prosecution or harassment, and walk off with it.
- hardware keyloggers that are hard to detect must be prepared. An investigator would have trouble having clandestine-ready hardware for any given laptop model ready.
A software keylogger or spyware program / trojan can equally be installed, but a number of methods exist for detecting these with a reasonable degree of reliability, including virus scanners, and cryptographic checksums that can be compared with a central server, e.g. some equivalent of Tripwire or another host-based intrusion detection system (HIDS).
Most importantly, though, the moment something like a keylogger or other hardware exploit is on your laptop, it does not matter what other security measures you take. Someone will always have access to your laptop from now on.
If the above applies, there is not much point to reading the rest of this article — it is the equivalent of telling a friend a Gmail password, then changing it — while he is watching. The only ways to deal with this are
- buy a new laptop
- assume that all communications are bugged, all files can be intercepted / opened, and only work with data that does not matter
Be hind the scenes of the fictitious episode above, a forensic investigator took a full image of the user’s laptop. There was no effort made to hide what was going on, nobody told him about his rights concerning search and seizure, habeas corpus and illegal detention, customs regulation, court and government rulings regarding data investigation, etc. He was simply coerced into providing access to his information. All attempts to encrypt, or hide, data on his laptop, and all mechanisms to foil intruders, came to naught. The government in question, regardless of the (il)legality of its customs agents’ actions, now has a full dump of the user’s laptop, which may or may not include saved passwords for his webmail account, confidential company materials, a (weakly) password-protected Excel list of passwords, personal photographs, contacts, etc.
I’ll leave it to the imagination of the reader why this might be a bad thing.
If you maintain constant visual contact with a confiscated laptop, and can determine, with 100% assurance, that nobody has managed to slip something dodgy on to it, great.
However, the best way to secure yourself against compromise is to assume that any data on a laptop is forfeit and to avoid having any information on the laptop to start out with. Remember — even if nobody installs anything, it’s pretty easy and quick to just dump a full storage device and play around with its contents later.
No amount of confidential information is worth the life, safety, or freedom of the person holding it (aside from exceptional situations — we’ll assume there’s not much wartime spying going on here.)
It is the responsibility of an employer to teach any business traveler two things:
- Cooperate with authorities — regardless of what the situation is, nobody on the road for work should have to be a hero
- Understand basic data protection techniques, including taking due care with creation of information so nothing described in this article actually becomes an issue
The point of all this is to avoid having to not cooperate or having to worry about data while on the road.
A few simple things might provide some degree of protection, but not a whole lot.
Set up a dummy account. Keep it logged in. Ensure that your login window does not show a list of users, but rather a username/password field, e.g. not this
but rather this:
When prompted to log in, do so with the dummy account.
Note that this will only fool idiots.
A user cannot give up a key that he does not have. Bruce Schneier wrote about this idea — allow a user to encrypt his laptop / files with a random key at some point before he is at risk of having his laptop accessed at the border. Give someone else the password. After passing the border, call this person to retrieve the password.
The downside to this is that, under something like RIPA, a user may face legal consequences for having encrypted material in his possession for which he cannot / will not provide the password. The law puts the onus on the holder of the data.
Furthermore, this may expose the person carrying the information to harassment and difficulty entering the country.
A 64-GB thumbdrive, or a DVD containing personal/confidential data, could be hidden somewhere in a user’s luggage, or mailed out of band (e.g. FedEx). However, that carries with it risk of interception. If it is found on a user’s person or baggage, the user can also be coerced into giving up an access code. If it is mailed separately, it may be very difficult to crack (e.g. PGPDisk) but there is still the risk that the wrong persons get their hands on it.
All data on a user’s laptop should be backed up before he leaves. This can take the form of incremental backups, or a full disk imaging. This is useful in case a full restore from scratch to a new laptop is necessary.
All users should be storing their important work data on a network drive anyway, see a little further down as to why.
A properly paranoid company will make a travel build available for its international travelers. This is a stripped down OS configuration, containing as few hints as possible as to the nature of the company and its business.
It makes sense to do this anyway to avoid loss of confidentiality from lost/stolen laptops. Make sure that someone on the road only has what they absolutely need on their laptop. It’s understandable that someone wants to work on a presentation or document on the plane, but in this case, it is important to educate users about the need to only carry the data that is absolutely necessary for the current trip.
Unfortunately, that covers locally archived emails, and breaks down on trips involving multiple clients. Furthermore, if the files a user is working on, say, during a flight on in a departure lounge, are actually highly confidential (e.g. the example of the merger negotiation)
Boy, the consultants will scream about this one.
Use virtual machines, such as VirtualBox, or VMWare. At the very least, this allows reasonably quick restore of compromised working environments, and can be used to restrict access to a host OS by dodgy websites. No particular benefit to travelers, except to add another layer of obfuscation — it is conceivable that an encrypted VM could be used for something like the “One-Way Encryption” environment above, completely masking what files / applications / sites are used.
Most mobile users have access to remote working tools via VPN.
I once completed an architecture project that provided a Citrix environment over an IPSEC VPN to users. A limited desktop, located on a hardened server in a DMZ, was presented to users. Someone connecting remotely had access to their data, could work remotely, and download folders and individual files.
These could be the files that were backed up / copied to the network drive earlier.
Webmail interfaces (SSL-protected, via IPSEC) allow users to get around having to keep mail archives on laptops — unfortunately, most companies do not understand the concept of sufficiently large server mail quotas. Disk is cheap. Buy some.
For added peace of mind, users traveling to a country whose border patrol or police are known as a source of risk should be limited, via profile, to a subset of data on the remote desktop server. Allow users to copy their files by project — and specify, either via user interaction, or via centralized management, which elements they have access to.
Most consulting firms already have “Chinese Walls” in place in order to prevent conflicts of interest, i.e. sanitizing one client’s data before using it with another so as to avoid exposing trade secrets. The user mentality is thus already in place.
Companies should ensure strict logging of all access events, as well as all user activity. Companies should maintain access profiles and correlate user activity with what is expected — a sudden attempt to dump entire file trees via remote access may be cause for alarm.
This ensures that, in case of a break-in by a foreign law enforcement agency using stolen credentials, it’s clear what was compromised. This is good practice in any case; in the Brazilian example earlier, police had presumably unfettered access to a major corporation’s international network — many major global companies have some sort of poor segmentation between country networks. Imagine the amount of scrambling and incident response work required to find out exactly what information they were able to obtain? A single user is no different, if you don’t know that he has been forced to divulge access, or if your external VPN connectivity uses weak authentication and credentials are extracted from a copied laptop drive.
Require users to use two-factor auth (e.g. RSA SecurID cards, chip cards, etc.) — this reduces risk from exposure of saved passwords or persistent authentication cookies dumped from a laptop.
In the extreme case that a user is forced to log into a corporate network via remote access, he should be given a a “panic account“.
This could take the form of “salomon.john” as opposed to “john.salomon”. Keep passwords the same to keep things simple – complexity causes people to become nervous and give things away. This account could even have access to the same dataset as the “real” account, while setting off all kinds of alerts and informing administrators that shenanigans are in progress.
User training is a strong prerequisite to make this work.
Many laptops have a SIM card slot. In the case of the Apple iPad 3G, one of the few reasonable security measures is the central remote wipe capability. Use it. Whether as part of a duress code mechanism, or in case of unexpected activity, it may be wise to err on the side of caution and just nuke anything via remote management.
This is an extreme solution to what is, at best, a paranoid situation, but it might be interesting for companies to set up VPN connections to trusted intermediaries located offsite.
This is a bit of a separate issue, but a user connecting to an IPSEC concentrator with an IP registered to a given Swiss bank may raise the curiosity of law enforcement agencies who like to know, out of principle, what a Swiss bank executive is doing in their country — thus giving cause for additional searches the next time the user passes through a choke point like an airport. Connections to an innocuous IP, however, may avoid such attention.
If the intermediary is trusted, a separate IPSEC connection can then be established from his servers to the corporate DMZ.
Controls of user laptops need not follow rational justifications — even developed countries have shown that their police and border investigations can be arbitrary. While it is unlikely that a given traveler’s laptop may be investigated in depth, if it happens to you, the probability of it becomes academic.
No company should ever expose its mobile users to danger through their mobile data. However, there are sensible ways to limit the potential fallout from unauthorized exposure by foreign law enforcement agencies to data that is simply none of their business. It just takes a bit of investment and willingness to change mobile working habits.