Drill · field
Border crossing
Procedure taughtPrepare an onsecret device before a checkpoint: short auto-reboot, at-rest encryption, duress PIN, a Tails key for the laptop.
A border checkpoint is where your phone’s "at rest" protection matters most. Walk the branches: each choice states honestly what it protects — and what it does not.
Start here
You are approaching the checkpoint. What state is your phone in?
Storage encryption is only truly "closed" in the BFU state (Before First Unlock) — after a reboot and before the first unlock.
Powered off (or rebooted just before)Good move
ConsequenceBest state. In BFU the decryption keys are not in memory: the content is unreadable without your passphrase. This is exactly why you set a short auto-reboot before travel.
SourcesGrapheneOS — Auto reboot
An officer asks you to unlock the device. What do you do?
What you can legally be compelled to do varies enormously by jurisdiction. This is not legal advice — research the specific country in advance.
I enter my duress PINNuance
ConsequenceHandle with extreme care: the duress PIN wipes the device, immediately and irreversibly. Depending on context, destroying data during an inspection can carry its own legal consequences. It is not a magic escape — see the "Coercion" drill.
SourcesGrapheneOS — Duress password
And for the laptop travelling with you?
I boot from a Tails key, internal disk untouchedGood move
ConsequenceGood practice: an amnesic session leaves nothing on the machine, and an encrypted (or empty) internal disk reduces what an inspection can reveal. Verify the Tails image before you leave.
Everything is on the internal disk, encryptedNuance
ConsequenceFull-disk encryption protects at rest, but a powered-on / sleeping machine keeps keys in memory. Shut down fully before the crossing; do not rely on sleep.
I comply, with minimal sensitive data on boardGood move
ConsequenceOften the pragmatic choice: the real defense is to have travelled with a device that holds little. Sensitive data stays at home (separate account, empty profile, encrypted offline backup), not in your bag.
SourcesEFF — Digital privacy at the U.S. border
And for the laptop travelling with you?
I boot from a Tails key, internal disk untouchedGood move
ConsequenceGood practice: an amnesic session leaves nothing on the machine, and an encrypted (or empty) internal disk reduces what an inspection can reveal. Verify the Tails image before you leave.
Everything is on the internal disk, encryptedNuance
ConsequenceFull-disk encryption protects at rest, but a powered-on / sleeping machine keeps keys in memory. Shut down fully before the crossing; do not rely on sleep.
I flatly refuseNuance
ConsequenceThat is your right in some countries, but the consequences (entry denied for a non-resident, device seizure, delay) are real. Decide calmly, in advance, per jurisdiction — not under pressure at the desk.
SourcesEFF — Digital privacy at the U.S. border
And for the laptop travelling with you?
I boot from a Tails key, internal disk untouchedGood move
ConsequenceGood practice: an amnesic session leaves nothing on the machine, and an encrypted (or empty) internal disk reduces what an inspection can reveal. Verify the Tails image before you leave.
Everything is on the internal disk, encryptedNuance
ConsequenceFull-disk encryption protects at rest, but a powered-on / sleeping machine keeps keys in memory. Shut down fully before the crossing; do not rely on sleep.
Locked but powered on for hoursNuance
ConsequenceAFU state (After First Unlock): derived keys stay in memory, which widens the surface for a forensic extraction tool. Power it off, or rely on auto-reboot (18h default, lower it for travel).
SourcesGrapheneOS — Auto reboot
An officer asks you to unlock the device. What do you do?
What you can legally be compelled to do varies enormously by jurisdiction. This is not legal advice — research the specific country in advance.
I enter my duress PINNuance
ConsequenceHandle with extreme care: the duress PIN wipes the device, immediately and irreversibly. Depending on context, destroying data during an inspection can carry its own legal consequences. It is not a magic escape — see the "Coercion" drill.
SourcesGrapheneOS — Duress password
And for the laptop travelling with you?
I boot from a Tails key, internal disk untouchedGood move
ConsequenceGood practice: an amnesic session leaves nothing on the machine, and an encrypted (or empty) internal disk reduces what an inspection can reveal. Verify the Tails image before you leave.
Everything is on the internal disk, encryptedNuance
ConsequenceFull-disk encryption protects at rest, but a powered-on / sleeping machine keeps keys in memory. Shut down fully before the crossing; do not rely on sleep.
I comply, with minimal sensitive data on boardGood move
ConsequenceOften the pragmatic choice: the real defense is to have travelled with a device that holds little. Sensitive data stays at home (separate account, empty profile, encrypted offline backup), not in your bag.
SourcesEFF — Digital privacy at the U.S. border
And for the laptop travelling with you?
I boot from a Tails key, internal disk untouchedGood move
ConsequenceGood practice: an amnesic session leaves nothing on the machine, and an encrypted (or empty) internal disk reduces what an inspection can reveal. Verify the Tails image before you leave.
Everything is on the internal disk, encryptedNuance
ConsequenceFull-disk encryption protects at rest, but a powered-on / sleeping machine keeps keys in memory. Shut down fully before the crossing; do not rely on sleep.
I flatly refuseNuance
ConsequenceThat is your right in some countries, but the consequences (entry denied for a non-resident, device seizure, delay) are real. Decide calmly, in advance, per jurisdiction — not under pressure at the desk.
SourcesEFF — Digital privacy at the U.S. border
And for the laptop travelling with you?
I boot from a Tails key, internal disk untouchedGood move
ConsequenceGood practice: an amnesic session leaves nothing on the machine, and an encrypted (or empty) internal disk reduces what an inspection can reveal. Verify the Tails image before you leave.
Everything is on the internal disk, encryptedNuance
ConsequenceFull-disk encryption protects at rest, but a powered-on / sleeping machine keeps keys in memory. Shut down fully before the crossing; do not rely on sleep.
Unlocked, in my handPitfall
ConsequenceThe worst case. An unlocked device in someone else’s hands is an accessible device: no configuration undoes that. Lock it now, and in future power it off before you arrive.
An officer asks you to unlock the device. What do you do?
What you can legally be compelled to do varies enormously by jurisdiction. This is not legal advice — research the specific country in advance.
I enter my duress PINNuance
ConsequenceHandle with extreme care: the duress PIN wipes the device, immediately and irreversibly. Depending on context, destroying data during an inspection can carry its own legal consequences. It is not a magic escape — see the "Coercion" drill.
SourcesGrapheneOS — Duress password
And for the laptop travelling with you?
I boot from a Tails key, internal disk untouchedGood move
ConsequenceGood practice: an amnesic session leaves nothing on the machine, and an encrypted (or empty) internal disk reduces what an inspection can reveal. Verify the Tails image before you leave.
Everything is on the internal disk, encryptedNuance
ConsequenceFull-disk encryption protects at rest, but a powered-on / sleeping machine keeps keys in memory. Shut down fully before the crossing; do not rely on sleep.
I comply, with minimal sensitive data on boardGood move
ConsequenceOften the pragmatic choice: the real defense is to have travelled with a device that holds little. Sensitive data stays at home (separate account, empty profile, encrypted offline backup), not in your bag.
SourcesEFF — Digital privacy at the U.S. border
And for the laptop travelling with you?
I boot from a Tails key, internal disk untouchedGood move
ConsequenceGood practice: an amnesic session leaves nothing on the machine, and an encrypted (or empty) internal disk reduces what an inspection can reveal. Verify the Tails image before you leave.
Everything is on the internal disk, encryptedNuance
ConsequenceFull-disk encryption protects at rest, but a powered-on / sleeping machine keeps keys in memory. Shut down fully before the crossing; do not rely on sleep.
I flatly refuseNuance
ConsequenceThat is your right in some countries, but the consequences (entry denied for a non-resident, device seizure, delay) are real. Decide calmly, in advance, per jurisdiction — not under pressure at the desk.
SourcesEFF — Digital privacy at the U.S. border
And for the laptop travelling with you?
I boot from a Tails key, internal disk untouchedGood move
ConsequenceGood practice: an amnesic session leaves nothing on the machine, and an encrypted (or empty) internal disk reduces what an inspection can reveal. Verify the Tails image before you leave.
Everything is on the internal disk, encryptedNuance
ConsequenceFull-disk encryption protects at rest, but a powered-on / sleeping machine keeps keys in memory. Shut down fully before the crossing; do not rely on sleep.
What this drill proves
Border-crossing safety is decided before the desk: device in BFU (off / short auto-reboot), little sensitive data on board, a Tails key for the laptop, and a legal decision made calmly. The onsecret setup prepares the ground; it does not replace your preparation.
- This is not legal advice: inspection powers vary hugely between countries.
- The duress PIN wipes — it does not "hide" anything, and destroying data may be an offence depending on context.
- An adversary with your unlocked device always wins; no option undoes that.
- The baseband, the SIM/eSIM and the IMEI remain identifying even with the device locked.
Sources: EFF — Digital privacy at the U.S. border · GrapheneOS — Auto reboot · GrapheneOS — Duress password