Over the past few months, the US and other countries have seen an uptick in border searches---including those of smartphones and laptops. There are several precautions you can take to defend your privacy, the most recent of which is a clever new feature from password-manager 1Password. But while it could secure your digital stuff, it could also introduce new risks.
The new 1Password feature, called Travel Mode, makes it easier for users to remove sensitive data from their password manager before they travel, and then reinstate it when they get to their destination or return home. It lets you create a set of passwords that are “safe for travel,” while temporarily removing any sensitive data you may not need on the road. It’s a way to reduce the exposure risk for nonessential data, or data that could impact others if revealed.
“It’s a way of simply not having certain data on your person,” says Jeffrey Goldberg, a product security officer at AgileBits.
Only monthly subscribers can take advantage of Travel Mode; the tool relies on syncing features that aren’t available to longtime 1Password customers who bought a one-time license and sync their password vaults through a third party like Dropbox. Setting up Travel Mode also requires a bit of time, because users need to create a customized travel vault.
The feature offers more flexibility, but doesn't magically solve travel-related privacy concerns. First, it deprives you of the ability to access some of your accounts. That in turn could lead to confrontations with border agents, particularly if they're not familiar with password managers.
"If it looks like you’ve taken extraordinary steps to avoid things being discovered during the search, then that may have consequences," Goldberg says. "In a sense we’re trying to make it easier to fully and honestly cooperate at the border. This is not a mechanism for thumbing your nose at border agents.”
Setting up a travel plan requires careful consideration of what's on a device and what could raise suspicion. For example, if you only store passwords to a few accounts in your travel vault, but leave numerous apps on your phone, it could be obvious that you've scrubbed some passwords. 1Password users and privacy advocates have also noted that savvy border agents who understand the feature could simply direct people to log into their 1Password accounts in a browser, turn Travel Mode off, and reinstate all of their vaults.
"Technical solutions that hide things on a device can get quite tricky, because we don’t want anyone getting prosecuted for obstructing justice or lying to a federal agent," says Sophia Cope, a staff attorney at the Electronic Frontier Foundation. "So with this 1Password feature the fact that it is erasing data and not hiding data is really important as a legal matter."
Unguarded data on a device can reveal too much to a border agent, but a device with too little data on it can cause problems in its own way by raising suspicion that the user has something to hide. "In a lot of ways travelers are sort of damned if they do, damned if they don’t," Cope says. "They have to decide what’s most important to them. Is it that they’re going to protect their data at all costs? Is it that they have to get through the border no matter what? Is it that they need to avoid having their device seized because they can’t afford to buy a new one?"
The concerns aren't just hypothetical. Last week authorities charged a British activist under the United Kingdom's Terrorism Act for refusing to decrypt his laptop hard drive after being stopped at Heathrow Airport.
1Password's Travel Mode doesn't solve every border crossing privacy concern, but the more tools people have at their disposal, the more likely they are to give real consideration to their data privacy. "There’s a functional benefit of a person saying well, I don’t have my WhatsApp password in my vault, but an overzealous border agent can ask or coerce a traveler into somehow finding out the password," Cope says. "There’s a real legal question as to whether border agents can do that, but as a practical matter each traveler really has to understand given their unique set of circumstances what the risks are of different courses of action."
