CBP protections

leaded71

Hi, New user here. I have a pixel 8 pro that is running GOS. Just installed today. This will serve as a travel phone.
A friend of mine - dual French and US citizen had his phone inspected last return back to the US. I don't know exactly what they did - I don't think they did a data dump, maybe just a cursory inspection.

So I am a little nervous about the possibility. Certainly all my banking apps are on my primary phone which won't be on the GOS phone. However, mail, whatsapp, facebook and instagram are used during travel. Work email is a bit of a challenge since it is geo restricted, but I can get around with a vpn. There is not any thing illegal here, no porn or anything. There are some politically charged emails and social media. It would be hard for me to really scrub that. I heard of at least foreign nationals being denied entry for their political beliefs. Maybe I am over reacting, but I think we can all agree we are in a different state than we were 10 -15 years ago, even though CBP rules were the same. 5x uptick in phone searches. At any rate...

It would seem that the safest thing is to use incognito page on vanadium for each and then prior to customs logout of those pages and shutdown phone. However...

Here are the challenges.
1) email. I tried to login to the outlook webpage on the Vanadium browser, but without MS authenticator it won't let me log in. the back up email is similarly protected with 2fa/passkeys. I did have my 25 character backup code, but it would make me wait 30 days and I will be traveling in 2 weeks. Also if I have to do that everytime ,it would be tough.

2) Same challenges for social media.

3) I use Bitwarden and Authy for passwords/passkeys and 2fa respectively. duo for work email only I don't really want those on the phone but having them would allow me to get into everything I needed.

Any ideas of how to secure the phone? Apps and best practices?

Thanks,
L

mr_r0bot

leaded71
When discussing this with some vulnerable communities, I always go back to threat models.
If this is going to be your travel phone and you have another phone, can you segment spicy items to the other phone so there isn't anything on this phone for CBP to find?
If there is anything you need, can you logout/delete the apps (social media/personal/etc) before passing through customs and leave non-sensitive info on the phone?
I would perhaps lower authentication factors disclosure in the threat model w/r/t CBP, as there hasn't been evidence of them taking them, and you can reset them after the fact. But anything that could be gathered like contacts, social media, or evidence of past activites, etc, are probably much higher on their collection priorities.

If you can keep things you are worried about on a separate device, consider powering that one off and mailing it back to yourself in the states so it skips the in person border checks.

DeletedUser622

leaded71 Any ideas of how to secure the phone? Apps and best practices?

GrapheneOS is already secure enough. Disable fingerprint, use long passphrase and they won't be able to get inside your phone.

Zayne

Just for interest?

Is there a way package a phone inside the suitcase so that they can't see it on the detector and it the packaging itself also don't looking suspicious?
The you could just give them a dummy phone if they ask for your phone.

Or alternatively you could give your phone to a friend who has US citizenship, because they can't deny them entry to the country, even when the deny to cooperate in any searches.

jcom

DeletedUser622 If you don't unlock for them, they can seize the device: https://www.cbp.gov/travel/cbp-search-authority/border-search-electronic-devices

"all travelers are obligated to present their electronic devices and the information resident on the device in a condition that allows for the examination of the device and its contents. If the electronic device cannot be inspected because it is protected by a passcode or encryption or other security mechanism, that device may be subject to exclusion, detention, or other appropriate action or disposition"

DeletedUser622

jcom I know it. The answer is outside the technical scope any OS would provide.