Coalition Slams DHS Plans To Demand Social Media Passwords

from the isn't-that-a-cfaa-violation? dept

Starting last summer, we noted that the Department of Homeland Security had quietly tested the waters to expand the information it requested of travelers entering the United States, to “optionally” include social media handles. By December it was officially in place. And then, just days into the new administration, the idea was floated to expand this program even further to demand passwords to social media accounts.

In other words: that escalated quickly. We went from “hey, maybe we could ask people to volunteer what their social media profiles are” to “hey, let’s demand all social media accounts, including passwords” in, like, six months.

In response, a ton of human rights and civil liberties organizations have posted an open letter condemning this dangerous plan.

This proposal would enable border officials to invade people?s privacy by examining years of private emails, texts, and messages. It would expose travelers and everyone in their social networks, including potentially millions of U.S. citizens, to excessive, unjustified scrutiny. And it would discourage people from using online services or taking their devices with them while traveling, and would discourage travel for business, tourism, and journalism.

Demands from U.S. border officials for passwords to social media accounts will also set a precedent that may ultimately affect all travelers around the world. This demand is likely to be mirrored by foreign governments, which will demand passwords from U.S. citizens when they seek entry to foreign countries. This would compromise U.S. economic security, cybersecurity, and national security, as well as damage the U.S.?s relationships with foreign governments and their citizenry.

Policies to demand passwords as a condition of travel, as well as more general efforts to force individuals to disclose their online activity, including potentially years? worth of private and public communications, create an intense chilling effect on individuals. Freedom of expression and press rights, access to information, rights of association, and religious liberty are all put at risk by these policies.

The first rule of online security is simple: Do not share your passwords. No government agency should undermine security, privacy, and other rights with a blanket policy of demanding passwords from individuals.

There are lots of reasons why the proposal is bad — but the security one is probably the biggest. People should never share passwords with anyone, but most especially foreign governments who have no interest in protecting them. And the letter is accurate that this will just encourage other countries to do this back to Americans (and others) and create a massive security nightmare. And that doesn’t even touch on the chilling effects created by such promised surveillance.

Of course, one hopes that this kind of insane policy will get people to recognize that passwords suck as a security system. At the very least, it should encourage people to use multifactor authentication that can’t just be handed over to some random border control person demanding your passwords. But that’s no excuse for DHS going down this path in the first place. It’s a bad proposal that won’t help DHS protect us, but will cause tremendous harm and create serious security problems.

Filed Under: , , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Coalition Slams DHS Plans To Demand Social Media Passwords”

Subscribe: RSS Leave a comment
Anonymous Coward says:

Re: Re:

If it comes to that, you could simply wipe any evidence that you gave a foreign Customs agent your passwords.

Just killdisk your PCs/laptops and factory reset your phones before coming back to the United States. Any evidence you let Customs in a foreign country access your accounts will be gone. US Customs will never have any clue of what you did.

Anonymous Coward says:

Re: Re: Re:

I believe most T&A require you to not share your passwords (maybe the phrase "[company employees] will never ask you for your account information online" rings a bell).

Failing that, the CFAA criminalizes unauthorized access- which, unless you grant written permission, it would be trivial to argue that doing anything with said passwords would be unauthorized access.

But honestly, the commit-a-felony-to-gain-ingress part is probably intentional. Commit crimes for the group so you’ll be less likely to turn away from the group.

Anonymous Coward says:

Re: Re: Re: Re:

However, any evidence could be wiped out, like I said. You could simply have Customs, in the country you want to enter, use your laptop, to search through Facebook, or whatever, using a VPN to hide what is going on, and then wipe the evidence from your hard disk using a secure wiping utility, such as KillDisk, before re-entering the United States.

Wiping the disk for this reason is not currently against the laws in the United States, though there have been calls to ban products like KillDisk or the former Evidence Eliminator.

Anonymous Coward says:

“one hopes that this kind of insane policy will get people to recognize that passwords suck as a security system. At the very least, it should encourage people to use multifactor authentication”

while I understand your point and where you’re coming from I can’t help but think the grinding wheels of bureaucracy would just require the multi-factor authentication code as “part of” the account password

Bergman (profile) says:

Re: Re: Re:

So instead of just seizing your laptop, they’ll seize your key ring (and all the electronic keys attached to it) just to be sure. If your phone is where the code generating app lives, they’ll take that too.

If you use a third party to generate the codes in the cloud, they’ll take that password as well. If you leave your ability to generate codes at home…why are you traveling with a device you cannot unlock, again?

Anonymous Coward says:

Re: Re: Re:2 Re:

Your devices will not give then your other Email accounts if you do factory reset and wipe the phone before going through Customs.

Wiping your phone before going through Customs is highly recommended and very wise. When I go on road trips all over North America, I always wipe my phone with factory reset before crossing the border into either Canada or the United States.

Wiping your phone before going through Customs does not violate either Canadian or American law.

Anonymous Coward says:

Re: Re: Re:2 Re:

As far as internet history on your phone provider, than can be taken care of by always using a VPN when surfing the Interenet on your phone. The only thing your phone provider will be able to tell them is that you connected to a VPN.

As long as that VPN provider is not in the United States, it is not subject to American laws.

Anonymous Coward says:

Re: Re: Re:3 Re:

There is also one provider right now, for 110 Euros a month, that provides a totally anonymous SIM card you can use.

Jammerspro provides such anonymous encrypted systems, including an encrypted router that automatically routes through a VPN. You can connect to that through your phone’s Wifi, and your phone provider will not have any records they can give you.

This router connects to your normal home or business broadband service, and can be used to anonymize Internet on any device that connects to it.

You just use this router with any VPN provider on the market, and any device that connects to it will go through the VPN, including your phone, leaving no internet connection history on your phone provider.

Also, a mobile provider outside the United States is NOT SUBJECT to United States laws, and cannot be compelled to hand information over to the US government.

Just do that, and then factory reset your phone before going through Customs, and CBP will n4ver figure out what you are up to.

Cowardly Lion says:

Re: Re: Re:4 Re:

All fine in theory. And for people who are comfortable with fairly advanced IT. But you’ve repeatedly talked about nulling your devices and using spurious online presences just to cross a border.

Non of what you are suggesting is realistic for everyday people. The answer isn’t to spend 110€ a month to avoid government sanctioned breaches of your security and privacy, it’s to resist stupid laws. And in my case, not even contemplating entering the USA.

Anonymous Coward says:

As far as them wanting to see what you are watching on YouTube, that can be taken care of right quick. YouTube does allow you to clear your watch history and search history. Just clear those, so CBP cannot find out what you are watching on YouTube.

Also, a good idea, as I have said, is to killdisk your laptop and then reinstall Windows and and all your programs, so the forensic examination of your laptop will get nothing.

Anonymous Coward says:

A positive side to giving away your passwords

You are no longer able to be legally held responsible for anything on any site you hand a password over for. Since you have no legitimate ability to stop a DHS agent from handing out that information to anyone, literally anyone could be in your account sending out threats, porn, etc…

I see this as a win. Its all poisoned fruit. You can claim the DHS agent did it from that moment on.

Paul (profile) says:

Re: Re: A positive side to giving away your passwords

The thing is you have no idea what they copied or if they installed some app on your facebook account or used SSO to get a long term refresh token to your data.

Once they have this power they will learn all the tricks, install backdoors, create lists of your contacts and start going after friends of yours or friends of your friends the next time we need to root out communists.

This is much worse if you understand security theory then you may think.

Anonymous Coward says:

Re: Re: Re: A positive side to giving away your passwords

Well, you can simply delete your Facebook account and make a new one, make all their apps and tokens useless. Once your facebook account is deleted, and all the tokens and backdoors to your account will no longer work.

Then you just go and make a new facebook account, and DHS/CBP will not be able to get back on to.

Anonymous Coward says:

Re: Re: Re: A positive side to giving away your passwords

This is one reason to give CBP a “dummy” facebook account and hide your real account, so CBP/DHS cannot do that.

Just create a new Email address, the create “dummy” accounts for facebook, twitter, etc, and give the passwords for those to DHS/CBP and put those on your Customs form instead of your REAL accounts. CBP/DHS will never be the wiser.

Anonymous Coward says:

Re: Re: Re:2 A positive side to giving away your passwords

Your expert rationalizations and excuses for this outrageous behavior is quite inspirational … here, have a cookie.

Rather than finagling your way around stupid ridiculous laws and regulations, why not point out to your stupid ass government how they are being stupid ….. oh wait, because that will get you tossed in jail. And now they want to asset forfeiture your ass for “participating” in a “riot” if anyone suffers damaged property from protesters – even if they were just standing there … idk, maybe reporting on it and stuff.

Bergman (profile) says:

Re: Re: Re:3 A positive side to giving away your passwords

He’s being very clever, and he’s also completely wrong about how it will play out.

It is illegal under US law to destroy anything that might be used as evidence — even if you have committed no other crimes for it to be used as evidence for. Violating this one will get you 20 years in federal prison.

Lying to a federal agent is illegal under US law. People have been convicted under this one for simply having bad memory, for amending their testimony as they remember more facts, and even for catching a federal agent lying — the agent is presumed to be truthful barring VERY solid evidence otherwise, therefore disagreeing with the agent about what you said in an interrogation is: a felony! This one will get you 5-10 years in federal prison PER LIE.

So if you create a fake Twitter account, fake Facebook account, fake email account and give those to a federal agent at the border, that’s 5-15 years in prison right there, and all they need to do to prove you’re guilty is a google or wayback machine search. If you factory reset your devices, that’s another 20 years in prison, possibly per device.

His ‘clever’ plan to avoid committing a felony punishable by 5-10 years in prison will cause him to commit felonies punishable by 35-50 years in prison.

Bergman (profile) says:

Re: Re: A positive side to giving away your passwords

It is a felony to lie to a federal agent or in official testimony. Police (state and federal) are presumed to be telling the truth barring VERY convincing proof otherwise.

If you disagree with what a federal agent says you said/did, that is considered sufficient proof by the courts to convict YOU for lying!

orbitalinsertion (profile) says:

And the people tasked with this invasion of privacy, organizations like CBP and TSA, contain vast collections of some of the biggest knobs on the planet as personnel. (Of course, not all, everywhere, but odds are not good that these are the ones you deal with.)

Yeah, I want the guys who steal underwear for no apparent reason looking though my email and chat or what have you.

orbitalinsertion (profile) says:

Re: Re: Re:

While I appreciate and understand all your pointers regarding this, most people simply are not prepared to deal with them. The only “active” social media account i do have is a “dummy” already, but honestly i don’t want to delete my chat logs. As for email, i have never used Hotmail or any of its later names under MS, and I use an email client, and don’t leave things parked on servers.

Mitigation against an omnipresent totalitarian regime is nice, and honestly, if i were doing anything the gov was actually interested in, i wouldn’t use most services and have everything dummy accounts linked to burner devices and never use them near my networks. And sure i can nuke and pave hard drives, but that is a huge pain, especially for most.

The thing is, we’d rather fight this ridiculous government intrusion than have to adopt measures that we surely would if necessary. (And in some ways, it has been necessary for some people for many years already.)

It’s great advice, and i and many others have given similar advice, especially in IT fora. But here you are kind of mostly preaching to people who already know, and are more interested in dealing with the faulty system than how to avoid having your private or business info and intimate conversations pawed over my officious morons. At least in this venue.

a swiss guy (profile) says:

Shall I or not?

As I see it, most comments revolve around ways to trick with accounts you might have to provide.

At the moment I’m planning an extended vacation in the US for this summer. That means I first book a flight and hope we don’t get rejected by ESTA for whatever obscure reason. Then I book flights, hotels and cars in the US. And then I arrive at the immigration counter … with me comes my family with the usual assortment of phones and tablets and probably our complete digital trail.
So, how much do I fake in advance and hope it fits together? How good an actor am I and what’s to expect from my co-actors?

What’s at risk? Just a good time for the family and a lot of money? Or more?

Why should we go through all that hassle? Canada seems to be a nice and interesting place, too. Maybe Costa Rica. Maybe … I’m sure there are many places, where we’re welcome.

Is this still chilling or already quite cold?

Cowardly Lion says:

Re: Re: Shall I or not?

Unfortunately for those of us with an astronomical bent, there’s a total solar eclipse in the US in August. I’d really, really like to see it, but as you say…

It’s not ideal, but what with this, the TSA, Trump’s new immigration policies, banning teachers from the UK, I’m seriously considering a boat off the Georgian coast. Maybe a cruise from Bermuda or the Bahamas.

Bergman (profile) says:

Re: Shall I or not?

Trying to fake accounts would be lying to a federal agent, which is a felony punishable by 5-10 years in prison PER LIE.

Giving up your passwords to a federal agent is a felony punishable by 5-10 years in prison per account.

Destroying anything that could be used as evidence in an investigation of you (even if there is no investigation or no reason to be one) is a felony punishable by 20 years in prison.

All these guys proposing ‘clever’ dodges to avoid federal agents pawing through their accounts are not being as clever as they think, since they’re trading one 5-10 year felony for a whole set of felonies that could see them in prison for ten times longer.

Roger Strong (profile) says:

This ought to end well….

DHS Agent: "Hand over your Facebook password."

Visitor: "I don’t have a Facebook account."

DHS Agent: "I don’t believe you."

Visitor: "Sorry."

DHS Agent: "Look, it’s well-established that one can be jailed indefinitely if they won’t hand over a password we think they have."

Visitor: "But I…"

DHS Agent: "And that’s an American citizens. You’re not, so we can ship you to a third country for torture. We’ve done it before. A guy transiting New York on his way home to Canada, just to check on vague suspicions."

DHS Agent: "Hand it over, and no dummy accounts. We’d better see lots of activity and friends on that account. We’ll be examining your friends too."

Announcer (Facebook commercial): And that is just one reason why everyone should be on Facebook. Get your mandatory account today!

David says:

Well, that gives a standard defense for copyright infringement

“Did anybody else have access to your account?”

“Dozens of border agents.”

Case dismissed.

What people don’t seem to understand in all of the privacy discussions around handing over passwords is that passwords are not just something you use for _reading_ private account details. They are a handle to _tampering_ with a person’s identity. They will naturally _massively_ be used for planting evidence.

The CIA will be able to invent whole child pornography rings for people they don’t like and plant all the evidence for it without using any hacking tool.

This really beats slipping a satchel in someone’s pocket.

Cowardly Lion says:

Re: Well, that gives a standard defense for copyright infringement

It’s even worse.

In essence, in modern times where we can have hundreds of passwords to access all kinds of things, there are people who use the same password and remember it, and there are people who use different passwords and use a password manager; paper even.

If have some of your passwords or even one, they have an opportunity to expand.

David says:

Re: Re:

What about Facebook accounts that are only used for commenting on news articles?

What about them? They are the best for figuring out your political leanings. And this makes it possible to correct your comments if they are unsuitable for someone entering the Land of the Free and the Home of the Brave.

You don’t need to thank us, we’ll do it ourselves.

Eldakka (profile) says:

Re: Re:

Any website that went over to requiring a facebook account to comment on I stopped visiting. Perfect example was Techcrunch, when they went to requiring facebook I stopped visiting entirely. Even after they reversed that requirement 2(?) years later, I still don’t visit the site , with the exception of reading the articles there about their policy reversal, but apart from that I’ve never been back. I don’t trust the judgement of people who’d make such a stupid decision in the first place.

Anonymous Coward says:

No Excuse?!

“But that’s no excuse for DHS going down this path in the first place.”

No excuse except terrorism, pedophilia, drugs, crime, Muslims, and Hitler! If we forget these basic, never-ending wars, the government might lose our willingness to pay the taxes they levy and might lose our support for the outrages they commit in our names with our money.

I now feel a little un-American that I don’t use Facebook.

zarprime (profile) says:

I'm sure they'll do their "best" to secure this information.

So we have DHS compiling a massive database of userids and passwords for e-mail and social media accounts. That’s not a high-value target at all. Given virtually no government agency has managed to receive a passing mark for securing their systems it’s only a matter of time (and probably not a lot of time) before at least one organisation (hackers, foreign gov’t, et al) gets their hands on it.

I expect you’d see lower distribution if you wrote your userid & password on a bathroom wall.

Roger Strong (profile) says:

Re: I'm sure they'll do their "best" to secure this information.

So we have DHS compiling a massive database of userids and passwords for e-mail and social media accounts.

The userids and passwords aren’t the point. It’s about building a database of connections between people. Your email and Facebook accounts supply a list of who you know and communicate with, and often who THOSE people know and communicate with. Import the accounts of a few million travellers a year, and the connections add up.

Years later you become a suspect, because you know someone on Facebook who knows someone via company email who got radicalized. In the 2000s they kidnapped and tortured people for less just to check on those suspicions.

Anonymous Coward says:

1. If and when these policies become the norm, don’t visit the US unless absolutely necessary. If you do have to come here on business buy a burner phone in the US after you are inside.

2. If you are a US citizen do not carry your phone/laptop with you when on an international trip unless you have cleaned it of accounts you don’t the US government looking at. Ideally you bring a burner phone and a cheap 10″ tablet.

I cancelled all of my social media accounts years ago. I knew the information could be used against me someday and have never liked the idea of putting my life out there publicly. Business and professional writers/artists have a use for it but the average person is just playing with fire.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...