[Cryptography] detention and/or seizure if you don't give your passphrase to US CBP

Wed Feb 15 09:53:05 EST 2017

Hi --

US Customs and Border Patrol (CBP) claims unlimited authority, not
restricted by the Constitution, at "points of entry".  They also
claim near-unlimited authority within a "reasonable distance" of
any land or sea boundary of the US.  They have unilaterally decided
that 100 miles sounds "reasonable" to them.  Two-thirds of all
people in the US live within this 100-mile zone.

This leads to problems with password-protected and/or encrypted
devices.  These problems are not hypothetical:

> A U.S.-born scientist was detained at the Houston airport until he 
> gave customs agents the passcode to his work-issued device.

The rest of the story (1600 words) by Kaveh Waddell is at: 
   https://www.theatlantic.com/technology/archive/2017/02/a-nasa-engineer-is-required-to-unlock-his-phone-at-the-border/516489/

The story correctly quotes CBP policy:

>> CONSEQUENCES OF FAILURE TO PROVIDE INFORMATION:
>>  Collection of this information is mandatory at 
>> the time that CBP or ICE seeks to copy information from the 
>> electronic device.  Failure to provide information to assist 
>> CBP or ICE in the copying of information from the electronic
>> device may result in its detention and/or seizure. 

Reference:
  https://www.cbp.gov/sites/default/files/documents/inspection-electronic-devices-tearsheet.pdf

==============

This leads to some hypothetical but entirely plausible situations
with considerable downside potential:

  1)  Suppose your battery dies while you're on a day trip to
   Tijuana.  Your device gets seized.

  2) Suppose you are on vacation. You give your phone and laptop
   to your family to take home while you go on ahead, or stay
   behind.  Your spouse and children miss their flight while
   CBP tries to extract the passphrase from them.  Then the
   devices get seized.

  3) Suppose your devices contains random numbers that you
   cannot possibly decode, such as are attached below.  You
   miss your flight, and your devices get seized.

The previous PGP block started out as 512 bytes from a high-grade
random number generator, although you could not possibly prove
that.  Also, it was public-key encoded to a recipient for whom
no private key has ever existed, although you could not possibly
prove that.