Taking a break from writing about Open Source Intelligence (OSINT), I thought now would be a good time to write about a topic relevant to me right now. I have been accepted to speak at Insomni'hack in Geneva, Switzerland in March and Hack in Paris in June. While I have been outside the United States, I have only flown to Canada. I have also traveled to Japan, Singapore and Guam, but that travel was via submarine and I did not work in information security when I made the trip.
Seeking information from people in the same profession as me as well as those who travel more than me, I turned to Twitter to ask for advice. I was showered with advice from a wide variety of infosec personalities. The advice ranged from general travel advice to strategies for escaping unlawful capture and detention. Through this article, I will share some of the advice and add my own preliminary analysis to some of the information.
The first piece of advice was to take kevlar shoelaces and an escape kit consisting of lock picks, handcuff keys and similar tools. While this is logical for some people and those traveling to some countries, I have not found anything definitive showing that lock picks are legal in Switzerland. I found a wiki article that shows that similar to Tennessee and Virginia, France has somewhat strict laws governing possessing such tools. While I have only traveled to Canada via air, I always operate under the assumption that someone in some position of authority can and will search my bags. Being detained for having anti-detention tools does not sound like a very fun trip.
Encryption was another topic of conversation regarding international travel. I had thought about half of this consideration - the part about encrypting everything and restrict access. I did not factor in that some countries require people using encryption to obtain a license and that the countries may limit the algorithms and key strengths available for legal use. This one could be innocent enough, but another thing one does not want to have to explain to the authorities. I found this website in understanding the laws across the world and ensuring that I do not unintentionally break any laws.
Faraday bags came up. I really liked this idea. For those unaware of what a faraday bag is, it is a bag made of one or more materials that restrict the contained devices from sending or receiving data due to the makeup of the bag. Forensic examiners frequently use these to prevent remote wiping or technologies similar to "Find My iPhone." For someone not conducting such an examination, they can be a blessing or a curse. If you have possession of your devices, you can easily control the signals in and out, which can restrict potentially malicious activities like AirDropping malware and inappropriate pictures, or even legitimate pictures. The curse comes when your backpack is lost or stolen and you cannot get your "Find My iPhone" signal to your device before the battery dies because it is in the bag. Another consideration is airport security. I am not sure if the X-Ray machine can see inside, so it will likely warrant a very thorough check, a possible delay and possibly a search for a new backpack.
Lesley Carhart provided me a link to a blog she wrote on the topic. This blog has excellent material on both technical and non-technical topics. She covers things like prescriptions, over the counter drugs and clothing. Lesley also echoes many sentiments relative to planning, checking with the State Department (if you are a U.S. Citizen) and having a plan for escape. The final piece of her blog is the piece about power converters since some countries are on 240V and others are on 120V. Mac power bricks have a World Travel kit with an adapter for most countries' outlets.
The final pieces of preparatory study for traveling are the most logical loose ends to tie together. Check with the CDC (if you are in the U.S.) regarding which vaccinations they recommend for travelers to your destination. Consult your physician to ensure you are up to date. Despite the privacy implications, consider enabling Apple Health with Emergency information (if you use an iPhone). Some people said to carry some cash and a debit card. Photocopy your passport. Check to see if there are any State Department notices or alerts for your destination or connecting locations. I was also advised to find out how the locals dressed and dress accordingly, so as not to stick out as a tourist.
The absolute final piece of advice comes from me, the person who has not traveled outside North America via plane, I visited Asia while in the Navy but arrived and departed via submarine. I plan on making business cards on cheap home business card printing paper that has the U.S. Embassy address, phone number, and a small map on one side. The other side will have common phrases and the pronunciation of the words on it. I will revisit this topic after I return from my June trip to validate the advice and provide advice of my own beyond this.
