Border Insecurity (Update)

I just returned from an international trip. I’m going to integrate these into the original post here, but for now I’ll just relate my recent experience and key takeaways.

Background

I’ve been rather paranoid about traveling abroad, despite having done it many times before. More specifically, I was worried about returning to the United States and dealing with US Customs and Border Protection (CBP). Due to some admittedly anecdotal stories I’ve heard personally, I was worried that I might be asked to unlock my devices for inspection. It’s not that I have something to hide, but I have nothing I wish to share. (That’s a reference to the 2018 movie Anon.)

So I did a lot of research and planning (which was summarized in the original article). As I said in the original article, you really need to do this well before you travel – know what you’re trying to protect, choose what devices you’re going to take, and know what you’re going to say and do if you’re asked to unlock and/or hand over your device. For me, this was a matter of principle and I prepared myself to refuse to unlock my devices. They couldn’t deny me entry to my country, though they could delay me and/or confiscate my devices. I was mentally prepared to deal with these outcomes.

The Plan

I decided to leave my laptop at home, which sucked. I use my laptop for everything, but it has way too much personal data on it. So instead I brought an iPad with a keyboard case. I also brought my iPhone. I considered taking a ‘burner’ phone (I already have a Pixel 7a running GrapheneOS), but decided on principle that that was wrong. We need to be able to travel with our real devices. And iPhones and iPads have pretty good security, particularly if you enable Lockdown mode and restart them.

My plan was to enable Lockdown Mode and turn off my devices before I reached customs. I was also going to put the devices away (out of sight). If asked to produce them, I would get them out, but leave them off. They could, of course, turn them on – or I would power them up, if asked to. But I would not unlock them. (Note that I have Face ID and Touch ID enabled, but those biometric unlock features are disabled on reboot until you enter the PIN code. It’s referred to as Before First Unlock or BFU mode.)

I like to think of myself as an organized, prepared person. I did my research. I had a plan. But I didn’t practice that plan. I thought I knew what I needed to know, but when it happened, I realized things had changed. And it happened sooner than I thought it would.

The Reality

I was going on an Alaskan cruise. The entire cruise would be in the US or in “US waters”, but it would end in Canada. I had a two-leg flight home, starting in Vancouver, stopping over in a Midwestern US city, and then ending in my home state. I figured I would go through US customs when I landed in the US from Canada – at the end of the first leg. Nope. US customs happened in Canada. Despite all my international travel experience, it had been a while and I forgot that this sometimes happens.

So I realize this at the last possible minute as our transfer bus arrived at the airport and we get in the first long line. I put my phone in Lockdown Mode while waiting in line. This requires a restart. Perfect! Now my phone will be “BFU mode”. But before I meet the first security person, I power off my phone.

Well… I try to. I hold the power button down. I get Siri. Crap! They changed the function of the side button. In the moment, I got flustered and forgot how to get to the power-off slider on the screen. (You hold the side and volume up buttons simultaneously.) But I recalled that there’s an emergency mode… press the power button 5 times quickly. Yes! I got the screen slider to power off – I power it off. (If I had failed to turn it off within a few seconds, it would have called emergency services.)

The security person wanted to scan my boarding pass. CRAP! Guess where that was? On my iPhone – a QR code from my Apple Wallet. Not only did I have to turn my phone back on, I had to unlock it. I think Lockdown Mode prevented the QR code from being shown from the lock screen, which normally it would. I powered it up, unlocked it, and scanned the boarding pass code. Then I turned it back off… but at least two other people along this ridiculous security and customs gauntlet asked me for my boarding pass.

To add insult to injury, I had to scan my face multiple times, too. I first had to do this in order to get on the ship. I was not given any option not to. They used this picture to verify me every time I left and returned to the ship (when we were at port, for example). And I heard the guy who took my picture tell another passenger that it was also used for facial recognition on the boat, though I don’t know where. My face was also scanned at least twice during the customs/security process.

But in the end, no one ever asked to see (let alone unlock) my phone or tablet. I’m also a US-born white male who has Global Entry. Your mileage may vary.

My Takeaways

Given this one experience, here are the key takeaways for me. I’ll be going to Europe later this summer and maybe I’ll learn more then.

1. If you plan to turn your devices off or keep them locked going through customs/security, have a paper boarding pass in hand.
2. Go through the motions of your planned process before you ever leave home. Practice everything you may have to do, maybe more than once. Consider contingency options if your primary plan fails.
3. Realize that you may actually go through customs before you are on your home soil, depending on what arrangements the US may have with the country you’re in before you return home.
4. Realize that most airports have cameras everywhere. If you have to unlock your device using a PIN code, cover your screen while you do it.
5. Facial recognition is used everywhere now. It’s almost impossible to avoid. Even if you ask not to use a face scan at the security check point, your face was probably already scanned by cameras on the ceiling and elsewhere.

A couple final notes, and take these with a big grain of salt. (If you know that any of these are definitely wrong, please let me know.)

• Someone mentioned to me that if you are ever put on some sort of US suspicious traveler list, your Global Entry status will be revoked and you will be notified. This could be a sort of ‘canary in the coal mine’, if true – something you would know before you traveled.
• I had to hit a magic button going through customs. It had a red light and a green light. I got the green. But presumably this is a random selection system – if it had been red, I would have been subject to additional screening.
• If your paper boarding pass contains the code “SSSS”, that stands for “Secondary Security Screening Selection” (or apparently a checkerboard pattern for Southwest Airlines). See this article for details.

If you have info to share on this, please send me feedback.