[dhsysusbsjsi]

If you have a modern iPhone and don’t want the crazy hacks, a very very simple but effective tip is to power off your iPhone when exiting the aircraft. When the device powers up it is in “before first unlock” mode and is severely restricted in what it can do. The attack surface area is significantly reduced. They’re not going to burn one of their $100,000 per install exploits on your BFU phone the same way they do with a full physical access unlocked paid exploit.

Also lockdown mode to reduce attack surface area.

[marcusb]

> If you have a modern iPhone and don’t want the crazy hacks, a very very simple but effective tip is to power off your iPhone when exiting the aircraft. When the device powers up it is in “before first unlock” mode and is severely restricted in what it can do. The attack surface area is significantly reduced.

From a comment in the article:

"Schneier’s border crossing opsec advice is characteristically thorough, but the recommendation to simply ‘turn off your phone’ undersells modern forensic capabilities. As a security consultant who’s testified in border device seizure cases, I’ve seen CBP’s Cellebrite tools extract data from ‘off’ iPhones up to 72 hours post-shutdown via remnant charge in memory chips (see 2024 DEFCON demo). The article’s Faraday bag suggestion works, but only if activated before entering the 100-mile border zone – we’ve documented RFID sniffers in airport limo services."

[jstasmltwngrl]

I shut down my macbook before coming back to Canada and the agent threatened to confiscate it for a year. I unlocked it because it was purely a principle thing and a new laptop would've been expensive.

[throw0101d]

For the record (for Canada):

* https://www.cbsa-asfc.gc.ca/travel-voyage/edd-ean-eng.html

[Muromec]

How do you know they didnt install a rootkit?

[nolist_policy]

Good point. This applies to Android as well.

[Muromec]

It's a good advice if you are citizen and cant be compelled to unlock the phone or be denied entrance for not consenting to search.

The good opsec in general, I think, is to comply, not have an obvious burning phone setup, but to have nothing capturing attention

[lordofgibbons]

They can still hold you for a long time (days?) at the border without being formally charged with anything. That's what I've been told, not sure how true it is. A Canadian entering the U.S was held for 2 weeks with no charges - not just a entry denial.