Customs wanting power to force travellers to handover passwords and encryption keys

Forums › ICT Policies and Regulation › Customs wanting power to force travellers to handover passwords and encryption keys

1 | 2 | 3 | 4 | 5

Mad Scientist
29761 posts

Uber Geek

Trusted

Lifetime subscriber

#1252309 6-Mar-2015 14:38

What if you forgot your password?

JWR

821 posts

Ultimate Geek

#1252312 6-Mar-2015 14:47

I think they should be a lot more concerned about things like fruit fly importation and a lot less worried about people's personal data.

Mattmannz

471 posts

Ultimate Geek

#1252358 6-Mar-2015 16:25

Customs don't look after fruit fly.

I am certainly not a fan of having people look at my gear but at the end of the day they already have the power to do so via a warrant. Customs, IRD, Police and a number of other organisations can force you to hand over your login and encryption details now by gaining a warrant which doesn't take them very long. I think you can be pretty sure that not many warrants get turned down as well.

Being able to access this information at the border without a warrant is okay in my view. If they suspect you of something bad they won't just view the gear at the border, they will seize it and hold on to it until they have cloned it and done a full inspection. They are only going to do quick inspections on cases that are marginal. A quick inspection by Customs and you are on your way again.

MikeAqua

7779 posts

Uber Geek

#1252374 6-Mar-2015 16:53

On the Aussie border show they are frequently busting would be illegal workers because of the email records on their laptops.

Mike

Athlonite

1828 posts

Uber Geek
Inactive user

#1252380 6-Mar-2015 17:28

store everything in encrypted zip files upload them to the cloud factory reset PC or phone enter foreign country find my shiz now customs

qyiet

454 posts

Ultimate Geek

Trusted

#1252387 6-Mar-2015 17:41

Mattmannz: . A quick inspection by Customs and you are on your way again.

If that's what it was, I'd have no problem. If I could give them access to search the device in front of them that would be fine. But asking for a password is not that.

My metaphor for the difference that I object to is this:

Assume the police want to search your car, but it is locked.   They can ask you to unlock it for them, then conduct the search.   This I have no problem with.

However if they didn't trust you to unlock the car, they demand the keys. However they don't use them to open the car, they make a copy of them. Then use the copy of the key to open the car and make a search. Then the officer keeps the copy of the key. Possibly puts another copy on file, and anyone who has access to the file gets a copy of the key as well.

But it gets worse. The officer didn't just copy the key to your car, they copied the every key that was on your keyring.. your house, your business, your shed etc, and now anyone who reads the file has access to all that stuff.

Sure, if they need to search the car on reasonable cause: fine. But being able to access your car anytime from then on is not fine.   In addition getting access and keeping it to all your other stuff because you needed to search your car *really* not fine.

If someone asks for your password, they then have it.. forever. If they write it down on a file, everyone who ever views that file has it too, and passwords are often for more than just access to a single device.    The solution: allow customs agents the authority to demand the person in possession of device open it for inspection.   Don't demand a copy of the key in perpetuity.

Warning: reality may differ from above post

qyiet

454 posts

Ultimate Geek

Trusted

#1252392 6-Mar-2015 17:44

Athlonite: store everything in encrypted zip files upload them to the cloud factory reset PC or phone enter foreign country find my shiz now customs

Ah.. may want to use more than the encrpyion built into the zip format. That was aparently trivial to crack.

Warning: reality may differ from above post

Sharesies kids

Free kids accounts - trade shares and funds (NZ, US) with Sharesies (affiliate link).

Mattmannz

471 posts

Ultimate Geek

#1252396 6-Mar-2015 17:58

You don't have to hand over every password, only those necessary for inspection so only login and encryption keys.

You can obviously change those passwords after the inspection.

I think you are exaggerating the extent

Matt

cruxis

481 posts

Ultimate Geek

#1252404 6-Mar-2015 18:00

I thought there was an security feature that you could set up on a iphone or android that securely erases itself if a certain password was entered ? Give that password to custons if they ask.

Might be mistaken, sound like a good feature for apple to add I reckon. Is that what remote wipe does?

frankv

5680 posts

Uber Geek

Lifetime subscriber

#1252425 6-Mar-2015 18:17

Mattmannz: I am certainly not a fan of having people look at my gear but at the end of the day they already have the power to do so via a warrant. Customs, IRD, Police and a number of other organisations can force you to hand over your login and encryption details now by gaining a warrant which doesn't take them very long.

But they have to have some kind of probable cause to get a warrant. That's the whole point... they can't just randomly search people.

Equally important, they shouldn't do it because, as has already been pointed out, it's stupid.

Anyone with any sense wouldn't bring in anything dodgy on a laptop. They'd put it on an micro-SD card. And put it in their phone or camera or whatever. Or hide it somewhere about their person, perhaps even swallow it. Or maybe hide it in their luggage. Or mail it to someone inside NZ.

Or put it on the cloud and download it after clearing Customs. Although that obviously means that it's going to be visible to the GCSB, NSA, etc etc and their ability to crack encryption is unknown.

Or, if you wanted to be really tricky... replace the boot-up code and/or OS and/or drivers in your laptop with your own custom code which completely hides the presence of an SSD or partition.

Mattmannz

471 posts

Ultimate Geek

#1252433 6-Mar-2015 18:34

I think its unlikely customs will randomly search peoples electronic devices. Possible but unlikely.

If they want to check you out they will. I would rather have a quick check than have my gear seized.

qyiet

454 posts

Ultimate Geek

Trusted

#1252465 6-Mar-2015 19:03

Mattmannz: You don't have to hand over every password, only those necessary for inspection so only login and encryption keys.

...

I think you are exaggerating the extent.

I'm thinking about what would happen if one of our execs was asked to turn over their password to their laptop. It's domain joined, so to access it they would have to give them their domain username and password. Well guess what that is the same username/password for our VPN, our WiFi, our Webmail, Our File Servers, our internal Web Servers, and any other PCs that exec is allowed to access. So no, I don't think its an exaggeration to point out that when they take a password to access the laptop they get far more than that.

Qyiet

Warning: reality may differ from above post

afe66

3181 posts

Uber Geek

Lifetime subscriber

#1252466 6-Mar-2015 19:04

My thoughts.

So next month I'm going on holiday and on my spare hard drive will be the DVDs I have ripped to keep the small child content in a foreign land.

We all know ripping DVDs in NZ is illegal.

I would expect that the most common illegal thing you will find on hard drives in nz will not be kiddie porn, it will be ripped movies by very very very large margin, even ones have a physical copy of.

Probably got 50 DVD so 50 cases of breech of copyright at 5k fine each....

So what will Mr Customs officer do....no kiddie porn but the drive is full of illegal movies. Will they do nothing or will I be off to court..

What to do..

A.

Mattmannz

471 posts

Ultimate Geek

#1252470 6-Mar-2015 19:14

qyiet:
Mattmannz: You don't have to hand over every password, only those necessary for inspection so only login and encryption keys.

...

I think you are exaggerating the extent.

I'm thinking about what would happen if one of our execs was asked to turn over their password to their laptop. It's domain joined, so to access it they would have to give them their domain username and password. Well guess what that is the same username/password for our VPN, our WiFi, our Webmail, Our File Servers, our internal Web Servers, and any other PCs that exec is allowed to access. So no, I don't think its an exaggeration to point out that when they take a password to access the laptop they get far more than that.

Qyiet

He calls and let's you know his password is compromised and you immediately disable his account until he can change the password. In theory they might be able to access other data but I think that's a pretty long bow.

Mattmannz

471 posts

Ultimate Geek

#1252471 6-Mar-2015 19:15

afe66: My thoughts.

So next month I'm going on holiday and on my spare hard drive will be the DVDs I have ripped to keep the small child content in a foreign land.

We all know ripping DVDs in NZ is illegal.

I would expect that the most common illegal thing you will find on hard drives in nz will not be kiddie porn, it will be ripped movies by very very very large margin, even ones have a physical copy of.

Probably got 50 DVD so 50 cases of breech of copyright at 5k fine each....

So what will Mr Customs officer do....no kiddie porn but the drive is full of illegal movies. Will they do nothing or will I be off to court..

What to do..

A.

1 | 2 | 3 | 4 | 5