Traveling Abroad with Electronic Devices
Introduction
To maintain contact with work, family, and friends, most persons, when traveling abroad prefer to use some form of mobile electronic communication device(s). Mobile electronic devices such as laptops, cell phones, and tablets, when taken abroad, may be attacked with malware and automated attack tools. These devices, even when kept current with security software, may not be able to thwart such an attack.
As part of a research university, NDSU's faculty, scholars, and staff often travel abroad for research, collaboration, continued study, or to present at national gatherings. When traveling to certain countries where there is strong scientific competition, the country is not on friendly terms with the United States, there is civil unrest or political discord, or where violence and crime are prevalent, they may become victims of cyber-attacks, cybercrime, monitoring, or surveillance. This is particularly true if the individual is engaged in classified or proprietary research in a STEM (science, technology, engineering and mathematics) program. Institutional leaders who are politically or religiously active, fluent speakers of the language, and individual tourists may also be actively targeted.
Acknowledgment
Credit and appreciation given to Joe St. Sauver, Manager for Internet 2 Nationwide Security Programs and the InCommon Certificate program, for allowing the use of large excerpts from his articles "Travel to Destinations other than China or the Russian Federation," and Cyber Security and Travel to China or the Russian Federation," March 2012
What can happen to my mobile electronic devices when I travel abroad?
Depending on where you plan to travel to, electronic communication devices, when taken abroad, may be subject to involuntary official governmental review and possible duplication of the hard drive's contents.
NDSU and University System policies require that any hard drive that contains personally identifiable information, financial, proprietary, or intellectual property be encrypted. The use of encryption to protect information may be forbidden in some countries. And, if your encryption product allows you to "hide" information, those "hidden" areas can be detected, and you could be subject to criminal charges by the country's government. Because it is difficult to monitor encrypted traffic, the use of secure ("https") websites and/or the use of virtual private networks (VPNs) may be blocked by some countries.
Attempts to circumvent national censorship of certain websites, such as some mainstream Western social media sites, are discouraged. If you are found to be using a product to circumvent the blocking of censored websites, you may be warned, have your electronic devices confiscated, or you may become subject to criminal charges.
Personal privacy may not be respected. Even private spaces such as hotel rooms, rental cars, and taxis may be subject to video, audio, or other monitoring. This type of surveillance may be able to track your whereabouts, what you may be doing, what's on your electronic device, and what you may be entering into it. Conversations either in person or on a phone may be monitored. Local colleagues may be required to report any conversations held with foreigners.
What can I do to protect myself, my electronic devices, and my information when I am traveling abroad?
-
If possible, do not take your work or personal devices with you. Use a temporary device, such as an inexpensive laptop and/or a prepaid "throw away" cell phone purchased specifically for travel.
-
If you must take your electronic device(s) with you, only include information that you will need for your travel.
-
Be sure that any device with an operating system and software is fully patched and up-to-date with all institutional recommended security software.
-
When not in use, turn off the device(s). Do allow them to be in "sleep" or "hibernation" mode when they are not in active use.
-
Be sure to password or passphrase protect the device. Do not use the same passwords/passphrases that you use on your work and personal devices. The password/passphrase should be long and complex.
-
Minimize the data contained on the device. This is particularly true of logins and passwords, credit card information, your social security number, passport number, etc.
-
Assume that anything you do on the device, particularly over the Internet, will be intercepted. In some cases, encrypted data may be decrypted.
-
Never use shared computers in cafes, public areas, hotel business centers, or devices belonging to other travelers, colleagues, or friends.
-
Keep the device(s) with you at all times during your travel. Do not assume they will be safe in your hotel room or a hotel safe.
-
Upon returning from your travels, immediately discontinue the use of the device(s). The hard drive of the devices should be reformatted, the operating system and other related software reinstalled, or the device properly disposed of.
-
Change all passwords you may have used abroad.
Are there additional tips and guidelines that I can use when I travel to countries that are less than friendly or there is civil unrest, or where crime and violence are prevalent?
-
Use a physical blocking device on integrated laptop cameras, or disable them.
-
Physically disconnect any integrated laptop microphones Install a privacy screen on your laptop to discourage "shoulder surfing."
-
Disable all file sharing. Disable all unnecessary network protocols (e.g., WiFi, Bluetooth, infrared, etc.)
-
Backup any data you may have stored on the device. Leave unneeded car keys, house keys, smart cards, credit cards, swipe cards, or fobs you would use to access your workplace, or other areas, and any other access control devices you may have at home.
-
Clean out your purse or wallet of any financial information such as bank account numbers, logins, and passwords, any RFID cards (including U.S. Government Nexus "trusted traveler" cards) should be carried inside an RF-shielded cover.
-
If you need to send and receive email while traveling, create a temporary "throw-away" account on Microsoft Outlook or a similar service before you travel.
- Do not send messages containing sensitive data via email.
- Limit or avoid making or receiving voice calls, using voice mail, instant messaging, text messaging, or sending and/or receiving faxes.
Are there other resources where I can find information on the country(s) that I am planning to travel to?
There are several good resources to review when planning to travel abroad. They include:
- An informative brochure published by the FBI that covers information and suggestions for business travel abroad. Click here to download and read the brochure.
- The U.S. State Department has a website where you can check the safety and security level of the country(s) you are planning to travel to: https://step.state.gov/step/