The ANSSI, French government service in charge of IT security, has published a document (in French) providing brief advice to people having to travel abroad.
The ANSSI advices concerning preparation before travel are as follow:
- Review the applicable company policy,
- Review destination country applicable laws,
- Prefer to use devices dedicated to travel (computers, smartphones, external storage etc.) and not containing any data not strictly needed for the mission,
- Backup all of your data before leaving and keep the backup in a safe place,
- Avoid taking any sensitive data at all, prefer to use a VPN (or a specially set up secured mailbox where all data will be deleted after retrieval) to retrieve the data securely (this is one of the most on-topic pieces of advice, since this one prevents any sensitive data from being present on the computer when crossing the border),
- Use a screen filter to avoid shoulder surfing during travel,
- Apply a distinctive sign on the computer and accessories (like a sticker, do not forget to put one on the computer bag) to facilitate tracking and avoid any accidental exchange.
The linked document then goes on with other advice concerning the rest of the trip but this is less relevant regarding the current subject.
Some points may however be worth to add:
-
If your computer is seized, if you are requested ciphering keys and password, do not put up any resistance since it may lead you into legal trouble. I suppose you are traveling with some sort of mission, it would be too bad for the mission to be canceled because you were not in measure to attend the meeting or respect some contractual engagements. Customs may have plenty of time, you may not.
However, immediately inform your company IT staff and managers so due actions can be taken (revoking corresponding accesses, passwords, certificates, etc.) and discuss the issue with them to determine the way to proceed since the seized then returned devices may not be trustable anymore (impact and mitigation directly depends on the nature of the mission).
-
Customs are a two way passage. When preparing your luggage for the return travel, ensure that you have properly cleaned up you devices (again, not only the laptop: all devices including cellphones, external storage, etc.): send your data to your company (in a ciphered form, again either using a VPN or a secured one-time email account) then wipe the files using appropriate software, delete browser’s history/cache/cookies, delete OS temporary files, delete call, messages and voicemail history, delete information about used networks (Wifi accesses, proxies, etc.).
And while I’m at it, here are more general advices for the traveler:
- Be careful when you are offered any external media like a USB key or a CD. Be careful too when exchanging documents with other people using writeable external media (as a reminder, the write protection on SD-cards is software only and therefore cannot be trusted).
- Do not plug your cellphone directly into one of those free public USB chargers which are becoming more and more frequent in places like airports. Use them to recharge an portable power bank instead.
- No matter if your devices have been seized or not, do not plug them back on your company network unless they got at the very least a thorough check.
- At your return change all passwords which were used during your travel.
Article based on a StackExchange answer.