Or anything else you can't easily transfer. I can't help but point at passkeys in particular (or 2FA in general).

A variant of this is the well-known scene from a previous century's movie involving extracting an eye to bypass retinal scanner.

Six of the eleven times...

Crazy.

What city was this, if you don't mind me asking?

Joburg?

That is insane. Where do you live?

Brazil maybe?

I will ask this here again:

At what point did the German people find it morally acceptable to start killing Nazis?

At what point will the US stop accepting the boot and act to remove the tyranny stamping on our collective face?

> the issue is that when a phone is unlocked, they can just plug in a USB device and scrape everything off it

That's useless if the backup account and the main account use different keys for the home partition.

VeraCrypt (used to?) have this. It was called a hidden volume. One volume, but two keys, two passwords, and two different containers full of data. Technically, the second volume is written into the partition "from the back" using key 2, while the first volume is written "from the front" using key 1.

Fun fact, there's no protection against writing over data in the other volume if volume 1 + volume 2 exceed the size of the partition - and there can't be, otherwise the volume wouldn't be hidden.

For now the courts in the US have set a different barrier for automated extraction and hand searches. For now.

Why does the USB port need to even work anyways? It could just be designed to look like a USB port but fry whatever expensive and proprietary phone hacking device they bought from some scuzzy Israeli ‘security’ company when it’s plugged in.

It's hard to justify an iPhone Pro Max as a "cheap travel phone" though so you might actually need to buy a cheap travel phone.

> [most]

Your word memory is faulty as well

I hope to meet one some day.

Security concerns you need to think about when visiting the US are absolutely no less than those when visiting China these days. Treat it like a totalitarian dictatorship with more technological means.

I wouldn't say you are overreacting at all. I know someone who was detained for months on US soil after a phone search where the only "evidence" against him they found is illegal content sent by someone else to him on a group chat he doesn't even check. Had to get a lawyer and spend time in prison just waiting to be deported back.

The US is first world on a technicality: the first world is defined as countries that were allied with the US during the cold war. If not for that, it'd be classified as developing.

It's common to mix up developing/developed and third/first world because they were largely aligned during the cold war. But there is one first-world developing country.

My dad's eighty+ years old, he was born in the States, though he did give up his citizenship. He brings a "fake" phone when visiting family, he's been doing so for years.

Me; I just change all my tabs and recent history to slightly kinky porn and truth social. They do look hard, but they don't look hard.

I used to love visiting the US. I have many friends there, and I really enjoy staying in places like Seattle and SF. But I haven't gone there since Trump 1.

That said, I think protecting your privacy is a good idea in general.

Yes, I will probably never go back to the US. But I find it sad that my kids for example, will have to think twice before visiting, if they do.

> for visiting a supposed first world country.

... which by now is a banana republic of the worst kind. Can you interact sanely with an insane counterpart? Avoiding to visit would be my recommendation too.

Just out of curiosity, like what country would you not have to worry about this in?

The US is quite transparent about these rules, and certainly other countries are not necessarily searching peoples phones as publicly

But anytime I transit a country USA or any thing I fully expect to have zero rights

The point is not what they believe, but how to avoid both breaking the law and not giving up your data, isn't it?

As long as that's legal, what they believe doesn't matter.

You are not legally obliged to keep your data on your devices all the time.

You're right for non-citizens.

For citizens, no one needs to believe it. You give them your empty phone and they can't download your phone contents and contacts.

What do you mean?

There's a difference between polite pushback and being straight up disrespectful. It shouldn't matter as the cops shouldn't abuse their power and shouldn't attack people, but we live in the real world. The judge probably didn't want to have to deal with the potential future mess if op didn't learn their lesson and got beat up by a cop.

Yeah, but go tell that to the judge who’s just about to slap you with a sentence.

Unless you want to fight that all the way up the judicial food chain

There's a huge difference between misusing their power and not having perfect understanding of what they're allowed and not allowed to do.

I'm sure there are scenarios where the cop can confiscate the surfboard and the car. The distinction is probably somewhat vague even for highly educated lawyers, and cops cannot expected to be that.

He should have stood up for his rights, sure, but laughing in the cop's face and telling them they're full of shit is disrespectful, and at least where I live is a misdemeanor even if the original case is wrong.

To be fair to the judge we all had broken an ordinance about surfing in a certain area. It was enacted to protect swimmers in the summer. With that said, there was a storm with wind, rain, and currents that had pushed us into the area. Obviously there were also no swimmers out.

The ordinance was removed a few years later. This cop was also known to hate surfers. All the small beach town BS you hear about.

at some point you just take your lumps.

Most people don’t have boundless time or energy and just want things to go away.

… ironically this fact is used a lot in gaining confessions by police.

That's interesting. I don't even know most of my passwords (thanks to password managers).

With self-hosting, it's possible to easily bootstrap a clean phone with all your data and passwords from scratch, without relying on any third-party cloud services. The only thing you need to bring across the border is your brain (which contains the most basic information on how to set up your password manager) and maybe some kind of 2FA generator. Your password manager then contains all the other information you need to get everything running.

I don't think it ever makes sense to transport actual data across borders if you care about governments gaining access to it.

"Wiping is obviously extremely suspicious and asking for trouble"

It's sad this is the default view. It's his device, his data, his life on that phone. If he had wiped the phone before the interrogation it wouldn't be a problem. How long before? A second before? A week before? But wiping the data a minute later is suddenly asking for trouble.

We noted in the border search guide that lying to the agents in response to their questions is potentially a crime in its own right (even if it's not done in order to hide anything illegal). We thought that this made hidden volumes quite tricky, particularly if one's intent was to pretend to comply with a question or request while actually not complying.

Problem is „are you sure you marked for deletion all the correct things” because you could have already deleted it before traveling or moved to other device you don’t travel with.

Selection on border control might be arbitrary, they can hold you or send you back over a photo or something you wouldn’t think should be a problem.

Ideally you would like to have all wiped just in case but then you really stand out…

That's a more risky strategy. What if you added new files since the last time you updated the deletion profile? It's also technically more challenging. You have to think about what might be in RAM, caches, backups, etc.

The good thing about a total wipe is that it's very easy to implement, and it's hard for it to go wrong. You just encrypt the whole drive and, when you want to wipe it, erase the key.

Deleted stuff can easily be recovered. I think the full clean will remove the encryption keys hence making it unrecoverable.

Yes, this also has the advantage of speed perhaps. I can see, deleting specific apps (and their data) as thing #1, and thing #2 would be certain directories. Of course, the problem is, are icons going to be vanishing off the home screen, when the agent is looking at it? Or will the unlock -> screen coming on, be super slow?

Of course the problem there is, many people have an app store installed, and app stores have histories. And logs. And "what you used to have installed" is so easily found under Google Play, for example.

As someone else said in this thread, the law isn't code. It's not if-then statement based. It's also predicated upon intent in many cases. What actions did a person take, and why, when told to (for example) unlock their phone.

The problem here is that if you are asked to unlock your phone, any action you take to thwart that request by "trickery" to get data deleted, could be construed as 'deleting evidence'. So while some methods might make it more difficult for the border agent to realise "something happened", if they're suspicious still, then you're still in hot water.

In the eyes of the law, the court, and likely the jury, you've done a sneaky thing to thwart evidence collection.

The only safe method is a full wipe prior to travel. In this manner, you're not deleting evidence when told to hand it over. It's an entirely different bar. They can be cruel about it, and take your phone for a few months, but you're not going to be in legal hot water.

In as no one will see the phone is wiped until you are compelled to unlock it, there's no greater change of the phone being seized. You're already being investigated. Just be blunt, say "Whenever I travel, I just wipe it", and that's that.

This is why it's a shame that GrapheneOS has no viable backup solution. Its build in method is unreliable, and doesn't work very well, and is gitchy, it's a very well known problem.

And Android and ADB sometimes have issues with large backups of directories, and so you have to manage that with tar + stream and other business, but at least working around that is easy.

But if you could backup individual apps and all their data, you could uninstall all your privacy laden stuff, cross the border, and reinstall in minutes.

That's the true, legal way to travel safely. Especially if the app removal resulted in a 'shred' of the data files instead of delete.

If anyone has ever struggled with large data backup/restore, here's the only real method I've found for copying large swaths of files from/to via adb:

  adb exec-out 'tar --dereference --create /storage/emulated/0/dir/  2>/sdcard/backup-errors.txt' |dd of=/tmp/backup-$(date +%Y%m%d).tar && adb shell cat /sdcard/backup-errors.txt

  dd if=backup-20250309.tar | \
  adb exec-in 'cd /storage/emulated/0/tempdir; tar xpvf -  2>/sdcard/restore-errors.txt' && \
  adb shell cat /sdcard/restore-errors.txt

You can simply use an Apple account for your primary device and a Google account for your burner (or vice versa). Or set up a secondary Apple or Google account. Or use a device/OS that doesn’t require one of these accounts!

> UK visa requires a smartphone

I don't think this is accurate.

Well, assume your phone number is public knowledge.

I'm European and I know plenty, albeit the minority of those I know that went to the US, so I wonder how reliable are CBP stats.

Maybe my anecdotal experience is influenced by me being in IT, but still.

But why would that be legal? The device is owned by the individual. No judge signed any warrant search for the device. I can do what I want with my device - that is a basic right of property. Imagine if border guards seize money willy-nilly.

This part is pretty new. I wonder if my former colleagues have done any FOIA work looking into how travelers' disclosed social media accounts have been reviewed or analyzed!

It's reasonable for a country to want to know if you're likely to abuse your visa.

Eg your socials might show you are a professional paid speaker at conferences. If you applied for a tourist visa that would be reasonable to flag you and ask you if you have paid gigs on the wrong visa.

Europe will also ask the same questions for foreigners. If you're a young woman travelling on your own you can expect questions to challenge if you might be earning money as a nanny on a visitor visa. Checking their phone messages to see if they've been making arrangements to this effect is a very straightforward way to determine intent.

Not everything is an evil conspiracy.

You also have to provide every single email account you have used in the last ten years, all of them, forgetting to declare one is an offense.

There's no chances I can remember them all, especially as I've been contracting and get a new email every 3-4 months or so.

And they would have taken his phone, pulled it apart and cloned the memory to get the data. And in a month or three, returned his phone to him in some condition which may or may not include "working".

Maybe change your location then :P