OPSEC52 / Week 20 — Border crossings: the one checkpoint where your phone has almost no legal protection

Everywhere else, your encrypted phone is a fortress: a warrant, a lawyer and time stand between it and anyone who wants inside. At a border, most of that falls away. The defence is not a clever answer at the counter — it is what you decided to carry before you left home.

Threat model: border officers with broad search powers and forensic extraction tools; a device that is unlocked or merely asleep; biometrics that can be compelled; apps that open years of your life; and wallets or written seeds that turn a search into a loss of funds.

This is operational guidance, not legal advice. Border rules differ by country and by your citizenship — check the specific crossing before you travel.

Why the border is different

Most legal protections around a device assume a police investigation: suspicion, a warrant, a judge. Border control works on a different basis in many jurisdictions. Officers may be able to look through a phone or laptop without suspicion, copy data, or keep the device for a deeper forensic examination. What happens if you decline to unlock depends heavily on who you are: a citizen generally cannot be refused entry to their own country but may lose the device for days or weeks; a visitor can simply be sent home.

So the realistic goal is not “win the argument at the desk”. It is: arrive with devices that have little worth taking, in a state that is hard to extract.

Before you travel: carry less

The strongest move is boring: do not bring what you do not need.

• Use a travel phone where you can: a clean device with only the apps the trip requires, signed into the minimum accounts. Your daily phone — with years of messages, photos and sessions — stays home, or is restored to a clean state and rebuilt after you arrive.
• Log out of what you cannot leave behind. A phone that is signed into your email, cloud drive, password manager, messaging and exchanges is not one device — it is the keys to all of them. Sign out, or remove the apps and reinstall later.
• Turn on disappearing messages in the messengers you keep (see Week 15), so the history on the device is short by design.
• Laptops: full-disk encryption is the baseline (Week 8). Leave behind what you do not need for the trip; use a separate travel profile or account if you must bring the machine.

Crypto at the border

A border search is the worst place to discover your seed phrase was in your notes app.

• Never travel with a written seed phrase in your luggage, wallet or phone. The seed is the money.
• A hardware wallet without its seed is just a device (Week 9). Carry it if you need it, but keep the backup at home or split securely — and consider a passphrase (25th word) so the device alone opens nothing of value.
• Keep hot-wallet balances near zero while you travel. A watch-only wallet lets you see funds without carrying the ability to spend them; restore spending access after you arrive.
• Remove exchange apps or sign out of them. A logged-in exchange app is a balance, an identity document and a transaction history in one tap.

At the crossing: the device state matters

How your device is locked matters as much as what is on it.

• Power off before the checkpoint — fully off, not asleep. A phone that has been switched off and not unlocked since boot (“before first unlock”) keeps its data encrypted at rest. One that has been unlocked once since boot holds keys in memory and is much easier for forensic tools.
• Disable biometrics before you reach the desk. In many places a fingerprint or face can be taken from you far more easily than a passcode you know. On iPhone, holding the side button and a volume button briefly forces the passcode; Android offers a “lockdown” option in the power menu.
• Use a long alphanumeric passcode, not a six-digit PIN.
• Laptops: shut down, don’t sleep. Sleep keeps disk-encryption keys in memory.

At the desk: calm and truthful

• Do not lie to a border officer. False statements are a separate and serious problem, and they are the easiest one to create.
• Do not wipe or delete things in front of them. That can be treated as obstruction. All of the preparation above happens before the trip — that is the point.
• Know your status and your options in advance: whether you are a citizen, whether you can ask for a supervisor or a receipt for a held device, and who you would call. If you have a lawyer, have the number on paper.

This week’s move

Before your next trip, write a one-page checklist and run it the night before you fly:

1. Travel phone ready, or daily phone backed up and slimmed down.
2. Signed out of email, cloud, password manager, exchanges; disappearing messages on.
3. No seed phrase anywhere on you; hot wallets near zero; hardware-wallet backup at home.
4. Devices powered off before the checkpoint, biometrics disabled, long passcode set.

Ten minutes of preparation turns the weakest checkpoint in your life back into an ordinary one.

Curated by Cyber Satoshi. Part of OPSEC52 — 52 weeks, 52 privacy pillars, threat-model first. See also Week 8 (full-disk encryption), Week 9 (hardware wallet OPSEC) and Week 15 (secure messengers).