Skip to content
Naked Security Naked Security

Visitors could be forced to hand over phones when entering the US

Latest suggestion on 'extreme vetting' extends scope beyond the majority-Muslim countries already under Trump's spotlight and could require visitors to provide social media passwords

Hello, travelers, and welcome – more or less, depending on where you’re coming from and whether the border guards believe you – to the US.

Have you kept up with what our border agents are going to require of you? Not exactly sure what’s entailed in this “extreme vetting” that President Donald Trump has been promising to put you through?

Neither are we, but details are beginning to emerge. The newest is that the administration is thinking about demanding your phones.

The Wall Street Journal reports that the Trump administration is considering requiring the disclosure of the following from foreigners entering the US:

  • Mobile phone contacts
  • Social media passwords
  • Financial records
  • Ideology

The emphasis is on “considering”. These are not yet requirements.

The WSJ quoted one source – reportedly a counselor to Homeland Security secretary John Kelly – who said that the rationale is to prove beyond a shadow of a doubt that foreigners are coming into the US for “legitimate” reasons:

If there is any doubt about a person’s intentions coming to the United States, they should have to overcome – really and truly prove to our satisfaction – that they are coming for legitimate reasons.

This could go well beyond the majority Muslim countries the administration has already singled out in its travel bans: the WSJ’s sources said that alterations to the visa process could affect even those coming from traditionally staunch allies, such as France and Germany.

The potential new extreme vetting measures could affect even the 38 countries that are now part of the US Visa Waiver Program. That program allows citizens of specific countries – ones with healthy economies that are generally considered to be “developed”- to travel to the US for tourism, business, or while in transit for up to 90 days without having to obtain a visa.

It’s not routine for border agents to demand phones, but it happens. Sometimes, it even happens to natural-born US citizens. In February, NASA engineer Sidd Bikkannavar was forced to hand over and unlock his (NASA-issued and NASA-owned) work phone.

You might wonder how that could be constitutional, given that US courts are divided on whether police can demand passcodes without violating Fourth Amendment protection against unreasonable search and seizure.

But those are questions for the courts, and there are no courts in airports. Border crossings operate under different rules than the rest of the country. In the US, it’s commonly said that borders are a “Constitution-free zone”.

That’s not strictly true, as the ACLU notes. But search rules certainly are different than outside of these ports of entry. From the ACLU:

At border crossings (also called “ports of entry”), federal authorities do not need a warrant or even suspicion of wrongdoing to justify conducting what courts have called a routine search, such as searching luggage or a vehicle.

…or your phone.

According to the WSJ, the new extreme vetting rules could potentially force visitors to hand over their phones so that agents can check their contacts. Alternatively, visitors might be required to hand over passwords for online accounts so agents can scrutinize both public and private interactions.

Demanding social media account passcodes has already survived court blocks on Trump’s travel bans. Last month, Reuters reported that US secretary of state Rex Tillerson sent a flurry of diplomatic cables to American diplomatic missions, putting out edicts and then dialing them back as the courts ruled against the bans.

But he didn’t dial back a “mandatory social media check” for any visa applicants who’ve ever visited territory controlled by the Islamic State (IS).

A senior official reportedly said that the administration wants to “figure out who you are communicating with”.

In February, Kelly told a House Homeland Security Committee hearing that the administration would like to prohibit entry to those who decline to unlock their online lives:

We want to say, for instance, ‘What sites do you visit? And give us your passwords,’ so that we can see what they do on the internet. If they don’t want to give us that information then they don’t come.

As far as ideology goes, the administration is reportedly analyzing asking questions such as whether visitors support honor killings and whether they regard the “sanctity of human life”.

The current state of travel affairs

When it comes to travel right now, it’s hard enough for US citizens to keep track of what’s been proposed, what’s in the works, and what’s been blocked by the courts. It’s undoubtedly even tougher if you’re outside the US.

So here’s a summary:

  • Trump’s first travel ban on majority Muslim countries covered Iran, Libya, Somalia, Sudan, Syria, Yemen and Iraq. It banned travel into the US from those countries for 90 days and was just one of a set of wide-ranging immigration controls that also suspended refugee arrivals.
  • A New York court temporarily blocked the travel ban. A federal appeals court upheld the ruling in early February.
  • A revised travel ban dropped Iraq from the list.
  • The second travel ban was blocked by a federal court in Hawaii last month.
  • On Friday, attorneys general from 16 states and the District of Columbia filed a brief in the 4th US Circuit Court of Appeals, urging the appeals court to reject the administration’s request and NOT allow the travel ban to go into effect while we await the appeals court’s decision.
    The 4th Circuit Court of Appeals in Richmond, Va., announced last month that it will hear arguments on an aspect of Trump’s revised travel ban on May 8 and could rule this week on whether to uphold the Justice Department’s request for a stay.
  • The travel ban issue could reach the Supreme Court by mid May. Trump’s order might not fare well given the makeup of the current court. But if Trump’s Supreme Court nominee, Neil Gorsuch, gets voted in this week, his order presumably stands a much better chance.

Returning to the potential extreme vetting measures: in the past, we’ve asked readers for suggestions on what to do to ensure that their privacy, the privacy of their contacts, and their sensitive business information, is secure when traveling to the US.

Wired recently published a guide to getting past customs with your digital privacy intact, and it’s well worth a read.

One thing to note is there’s no silver bullet. For example, if you set up two-factor authentication on your phone so that your online accounts require a temporary passcode that’s texted to you, then remove your Sim card (perhaps mailing it to your destination) so that you can’t get at the SMS messages, you might plead inability to unlock with the CBP.

But just how well will that go over with the agents? As Wired notes, it could easily spike their suspicions and lead to lengthy detention and intense grilling.

Refusing to hand over passwords might seem like a sound option, but the Customers and Border Patrol threatens seizure and detention to those who don’t comply.

It should come as no surprise that in the wake of the revelations, there are those who say that all of this is moot as far as they’re concerned, given how little appeal there is in traveling to the States in these times:


21 Comments

More security theatre. The “bad guys” (if there really are any entering the U.S. in this way) can easily bring sanitized phones and passwords to clean social media accounts. Only legitimate travelers are inconvenienced.

As I am not a native speaker, maybe it’s just me but I found this sentence “On Friday, attorneys general from 16 states and the District of Columbia filed a brief in the 4th US Circuit Court of Appeals, urging the judges to reject the administration’s request to let its travel ban take effect while it considers its appeal.” to be rather confusing. So, the travel ban of the administration has been blocked by some court, now the Court of Appeals is considering whether to lift this block or not. Then the administration has sent a request to lift the block while they are considering if they should lift this block or not? And then a bunch of attorneys general (plural sounds weird to me, but I guess it makes more sense than attorney generals) urged the Court of Appeals to reject the administrations request, i.e. they asked the court to uphold the block of the ban until they decide if they want to uphold the block of the ban. Did i get that right?

PS: Seems a bit strange a court would undo the decision of a different court while deciding if they should undo or uphold the decision of a different court. Is that normal?

PPS: I truly was looking forward to visiting the US someday, for legitimate vacation purposes, but as it looks now I won’t be doing that, certainly not during the Trump administration. I’m not letting someone invade my privacy on multiple levels just so I can enter a country.

OK, let’s give this a go:

The administration came up with a second travel ban. A court blocked it. The government appealed that block, and its appeal is now pending. As we wait to hear the outcome from the appeals court, the administration has requested that its travel ban go into effect. On Friday, attorneys general from 16 states and the District of Columbia filed a brief in the 4th US Circuit Court of Appeals, urging the appeals court to reject the administration’s request and NOT allow the travel ban to go into effect pending the appeals court’s decision. So in essence, the tug-of-war concerns this: does the travel ban go into effect, despite the block, pending a decision from the appeals court?

I *think* that’s clearer. Unless you all send me back to the drafting table, I’ll ask for the edit to be made. My apologies for the convoluted language. It’s a convoluted thing, and I was up late tucking this story into bed…

Definitely better. Still convoluted, but such seems to be the nature of legal matters in most cases anyway.

PS on your PS: It is normal for courts to undo, or uphold, the decision of lower courts. I don’t know that the timing has much impost, as in, the executive order is being considered while the appeal is being considered. IANAL. But it doesn’t strike me as unusual.

And yes, “attorneys general” as a plural strikes the ear as wrong, doesn’t it? It makes sense, but we’re not accustomed to seeing a noun phrase pluralized by adding an “s” to a word that’s in the middle, not at the end, of the phrase…

I didn’t mean if it is normal that a higher court will undo/uphold a decision of lower courts. Rather that they undo a decision while they are deciding if they should undo or uphold it. Shouldn’t the default be that a decision is upheld until the appeals court decides to undo it? If you get convicted of a crime, and you appeal that conviction, they wouldn’t set you free while you wait on the appeals court decision, would they? To me it just makes more sense to stick with the courts decision until another (higher) court decides to change that ruling.

And finally, a PPS on your PPS: It saddens me, but does not surprise me, to hear people express an aversion to travel to the US given the current climate. It also disappoints me (but does not surprise me) when I hear from friends that they didn’t vote in the past presidential election because both candidates were anathema. On the plus side, our courts, along with many talented legal and political minds, are working hard to counter the slide to isolationism. Who can blame you for not wanting to travel here? Not me. But give us some time, and hopefully we’ll pull back from this unwelcoming approach to foreigners and the invasion of privacy that comes with it
.

I have travelled to a number of countries in Western Europe and North American (including ones where I do not speak the language) and I have only once felt really “alien” and that was in the Philadelphia Arrivals Hall and that was before all these additional vetting procedures came into place.

In those days a dour official took my passport and checked my name against a huge ledger – presumably of undesirables – and ask me the reason for my visit (business). That was all (no finger printing or searches), but combined with truly massive queues was enough to make me feel unwelcome and “alien”.

Now retired, it will take a lot to persuade me to want to travel to the US again. It’s a long expensive uncomfortable trek and if you are going to be treated as a proto-criminal or terrorist when you get there, it is far easier to go to somewhere like France and only suffer the brief disdain of their officials.

With these “give us our social media users/passwords” I wonder how they deal with people with password managers. If you ask me for almost any password save for my password manager password and maybe a couple of others I use which they wouldn’t be interested in, I have no idea what the password is. I couldn’t even tell you it if you showed it to me, it’s like 32 random characters. Would I be denied re-entry because I refuse to give them a password which I don’t have access to unless I’m at home? Note to self, buy prepaid flip phone for travel and carry a digital camera once again. This policy is absolutely the wrong direction!

Make sure that your password manager also requires two factor authentication, such as a Yubikey, held by a trusted person in your country of origin. They can refuse to authenticate while you are under duress.

The issue here is that the border agencies, by demanding access to social media, are invading not just the traveller’s privacy but also that of other people, who are not seeking entry. Those persons have no right to redress. They also may have communicated private information outside of a normal dialogue, without the traveller’s prompting. What might happen to said revelations?

We had already decided to stop travelling to the USA, until this crazy government is out of power, so the whole issue of passwords for social media is moot. We are also avoiding purchasing any products from the USA.

“avoiding purchasing any products from the USA” That will show Turnip – Not. But that should be real easy, almost nothing is made in the US. I’ve tried to avoid buying non-US items (to keep people employed here) for most of my adult life. It’s impossible these days. Shoes, pants, half the food, electronics,,,,. People should always support their local community when possible, it can save your own job too.

I think the best option is to just leave the phone at home if I ever decide to travel to the US again. Once in the US, just buy a burner phone for the duration of the visit. Problem solved.

Having never held a Facebook or Twitter account (yes really, truly, and legitimately – I have no interest in sharing my personal life with strangers), I wonder how I’d be dealt with when I fail to hand over passwords for said accounts?

How do you prove they don’t exist?

It’s impossible to prove a negative. But that doesn’t mean that the agents wouldn’t a) disbelieve your claim, b) check your online presence out for themselves to verify or disprove your claim, c) stumble on your name somewhere online, even if it’s not on Twitter or Facebook, d) get you in deep trouble by claiming that you’ve been deceitful.

Likely? I don’t know. But as another reader pointed out to another commenter on another travel-related story, the fact that you’ve posted in this thread means you’re online, somewhere, and potentially findable by hypothetically suspicious agents bristling with suspicion at your nonconformity/noncooperation/whatever spin they might put on it…

I’ve always enjoyed travelling to the US, both for business and vacation, and I have many US friends. However, I will no longer travel to such a country. As a security-aware person I fully understand why Trump wants to do this, but it is, in present circumstances, a step too far. This will have dire implications for the US tourism industry and likely put hundreds of thousands of folk out of work, The effect on business will be magnified by all the other anti-trade regulation he intends to put in place. I can’t see the economy surviving such an onslaught.

Government’s growing disregard for privacy is an established global trend. And the competitions for running the White House have so far trailed no promises on correcting things. In democracy, this must mean people are more concerned of other issues and are ready to compromise on privacy, viewing encroachments as “necessary evil” to maintain society securer (perhaps, until humiliation touches them personally).

Comments are closed.

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?