Travel and border crossings

Samuel, director of a legal aid organisation in Addis Ababa, travels to regional meetings several times a year. His phone holds years of chats with clients and their families, and his laptop holds the case files. On his last trip, a border officer took the phone into another room for 20 minutes and handed it back without a word. Samuel didn’t know what to check, so he checked nothing.

This guide covers what to do before a trip, at the border and when you’re back, so a search finds little and a device that went out of sight gets checked.

Every kind of journey

These kinds of trip come up again and again, and each has its own main risk:

• Regional borders and international flights: officials can search devices, ask for passwords or take a device out of your sight (NDI; EFF).
• Checkpoints and protests at home: a phone can be taken with no warning, so carry less and switch it off wherever it might be taken (SIIRF).
• Field trips to remote areas: the bigger risk is being out of reach. Agree check-ins, keep phones charged with a power bank and download offline maps and key contacts before you go (SIIRF; NDI).

The habits below cover all of them: carry less, lock everything down, agree check-ins and check devices when you’re back.

Before you go

1. Find out the rules where you’re going. Check whether the internet is censored, whether VPNs and encryption are allowed and whether border officials can demand your passwords (Security in a Box). If you could be detained, talk to a lawyer about your rights before you leave (Security in a Box).
2. Carry less. Take only what you need for the trip. Back up the rest, leave it at home or in secure cloud storage and delete it from the devices you take: what you don’t carry can’t be lost or copied (Security in a Box). Some people use a travel phone, a separate phone that holds only what the trip needs (NDI). If a second phone isn’t affordable, back up your main phone and clear off what you won’t need (Security in a Box).
3. Lock everything down. Update every device and give each account a strong, unique password and two-factor. Encrypt your devices and USB sticks too (Security in a Box; Phones and laptops). Use an authenticator app or a security key for two-factor rather than text messages, which may not reach you abroad. Lock phones with a PIN of at least six digits or a password, not your fingerprint or face, which someone can force you to use (Security in a Box).
4. Install what you’ll need before you leave. Put a trusted VPN on every device you take, from its official store or website (Security in a Box; Browsing securely). Don’t rely on VPN files passed round in group chats once you’re there: they’re a common way to spread harmful software (SIIRF).
5. Agree check-ins. A check-in is a short message at times you agree in advance, saying you’re safe. Agree who you’ll check in with and how often. Agree, too, how long a silence counts as an emergency and what that person does then (NDI; Your incident response plan). Add local contacts for where you’re going, such as a lawyer and a clinic (NDI; Access Now).

At the border or a checkpoint

• Log out of email and social media, remove or hide sensitive apps and clear your browser history (Security in a Box).
• Go through your chat apps. Delete sensitive chats, rename groups whose names give too much away (if you’re the admin) and turn on disappearing messages for sensitive conversations. In some places having Signal can draw attention, but having no messaging app at all can look suspicious too (Security in a Box).
• Switch devices off before you get there. Encryption protects fully only when a device is off (Phones and laptops).
• Know what you’ll do if you’re asked for a password. Laws differ: in some places you can challenge the demand, while in others officials can hold you or keep the device if you refuse (EFF). Decide in advance, with a lawyer’s help if you can (Security in a Box).

On the road

• Keep devices with you: at your feet on a bus, train or plane, not in checked luggage or an overhead locker. A hotel room isn’t a safe place to leave them, and neither is the hotel safe (NDI).
• Charge from a wall socket rather than public USB charging points, which can pass on harmful software (NDI).
• Treat shared and hotel computers as unsafe, and don’t sign in to work accounts on them (Security in a Box).
• On hotel, café and airport Wi-Fi, use HTTPS-only browsing and your VPN (Security in a Box). Wi-Fi and networks explains why.

If you could be arrested

Security in a Box has extra steps for people who could be arrested. Your whole team doesn’t need them, only the colleagues most at risk (Security in a Box):

• Know your rights before anything happens: whether you can refuse to unlock a device, whether officials need a warrant to take it and whether you can call a lawyer first.
• Back up your devices, then empty them. Keep work in secure cloud storage that you open in a browser rather than an app, and clear the browsing history after each session.

Remember: if violent interrogation or torture are a possible scenario, it is better to have empty devices, so you can provide your passwords without exposing yourself or others to higher risks.

Security in a Box, Front Line Defenders

Before a risky trip, agree with your team what you’d do if someone were detained: who coordinates, how you’ll talk to each other and how the family is involved. Make sure more than one person has admin rights in the group chats a colleague at risk runs, so the group isn’t lost with their phone. The Digital First Aid Kit’s page for when someone has been arrested walks through the rest.

When you’re back

If a device went out of your sight, assume it may have been copied or tampered with. Tampering means changing a device while it’s out of your hands, for example by installing hidden software that watches it (SIIRF).

1. Stop using it for sensitive work. Wait until it has been checked, or reset it fully (SIIRF).
2. Ask a helpline to check it. That’s what many groups do. Access Now’s Digital Security Helpline is free for civil society, day and night, and Spyware and surveillance explains what a check involves.
3. Look for the obvious signs yourself. Check which devices are linked to your chat apps, look for apps you didn’t install and check your main accounts for devices you don’t recognise (Security in a Box).
4. Change the passwords of accounts that were on it. Assume what was on the device was seen, then sign out every other session (SIIRF).
5. Reset travel devices. Do it before they join the office or home Wi-Fi again (NDI). Deleting data safely explains how to reset a device fully.

Bringing your team with you

1. Try it on your own next trip first. Follow the steps above, and note what was hard or slow.
2. Write it down. Add what goes on a trip and what stays behind to your security policies, and keep the check-in plan with your incident response plan.
3. Run a session, then meet each traveller. Before a busy travel period, run the session in “Teach it to your team” below. Before a risky trip, meet the traveller one to one: go through their devices, the VPN and the check-ins together, and talk through what they’d do if they were stopped or questioned (NDI).
4. Keep a chat open for questions. Travellers can ask before they leave, and tell you about anything odd while they’re away.
5. Look after shared travel phones. If your organisation keeps them, reset each one after every trip, and get them back from people who leave (NDI).
6. Check every three months. Look back at recent trips: were check-ins kept, did any device go out of sight and was it checked? Update your steps to match (Checklists and audits).

If it’s already happened

If a device is taken, lost or kept, go to Device lost or seized. If someone is detained, their safety comes first: get a lawyer and tell their support network (SIIRF). Don’t erase their devices remotely without legal advice. Access Now doesn’t generally advise wiping a device after an arrest: it can make the police more suspicious and add to the risk (Access Now).

Teach it to your team

Try this before your team’s next round of travel. It takes about 30 minutes.

• Prepare: put the steps from “Before you go” on a screen or on paper, and pick a real trip someone is about to make, or make one up.
• Exercise: plan that trip in pairs: what goes on the phone and what stays behind, who you check in with and when, and what you’d do if an officer took the phone into another room.
• Three questions: Why switch devices off before a border? If you miss a check-in, what happens and who acts? What do you do with a device that comes back after being out of your sight?
• Afterwards: meet one to one with anyone travelling soon, and answer questions in the team chat.