Asset Protection BLOG - Mark Nestmann

RFID Tags Enable 24/7 Surveillance [Part I]

Are you ready to begin living a tagged life?  If you are, the future is here, courtesy of radio-frequency identification (RFID) tags.

Stage 1 of your tagged life is now here, in the form of new high-tech driver's licenses, which can be used at U.S. border crossings in Mexico and Canada.  Each license incorporates a RFID tag encoded with a unique identification number. 

As you approach a border crossing, a RFID reader sends out a signal that an antenna on the tag picks up.  The tag in turn reveals its ID number.  By the time you arrive at the border crossing, Customs agents already have your name, address, photo, and other details in front of them.

Ordinary U.S. passports also contain a RFID tag.  The only difference is that the tag can't be read remotely, at least in theory. 

States on the U.S. and Mexican border have now started to issue RFID-equipped licenses.  The state of Washington now issues an RFID tagged "enhanced driver license," which can be used for border crossings to and from Canada.  In the near future, Arizona, Michigan, New York, and Vermont will begin issuing them.

Although there's no law requiring you to obtain an enhanced driver license, once you sign up, you open the door to privacy invasion on an unprecedented scale.  That's because the RFID tag number on your license is associated with your identity.  Anyone with a RFID reader—an item you can pick up for a few hundred dollars—can interrogate the tag and access the data on it.  Combine that with the growing number of products which contain RFID tags—credit cards, ATM cards, cell phones, key cards, etc.—and the potential grows exponentially for surreptitious tracking, wherever you go.

Some people don't believe that's a problem.  I do, though, because the data on the RFID tags in enhanced drivers' licenses isn't encrypted.  An identity thief, a stalker, a private investigator, or anyone else who wants to learn your identity, and potentially match it to the growing array of data tied to your tag number, can remotely interrogate the tag with a simple RFID reader.  You won't even know when it happens. (In contrast, the data on the RFID tags in U.S. passports is encrypted--although hackers have already figured out how to clone the data).

Combine this potential for abuse with the huge plans corporations—and the government—have for "people tracking" via RFID tags, and the potential for 24/7 surveillance is obvious.  For instance, an IBM patent granted in 2006 describes a network of interconnected RFID readers that IBM calls "person tracking units" (PTUs).  IBM envisions installing PTUs everywhere that people go—in airports, shopping malls, sports arenas, theaters, etc.  According to the patent, the PTU network would "keep records of different locations where the person has visited, as well as the visitation times."

How do corporate America and the U.S. government plan to use the massive amounts of data gathered through RFID tags?  Essentially, to facilitate 24/7 surveillance of everything you do and everywhere you go.  I'll have more to say about that in my next blog entry...stay tuned.

Copyright © 2008 by Mark Nestmann

Surprise, Surprise! U.S. Tracks All Border Crossings

One long-term goal of the War on (Some) Terrorists is to create a "lifetime travel history" of all U.S. citizens and visitors to the United States.

A critical component of the lifetime travel history is now in place: the Department of Homeland Security's "Border Crossing Information System" (BCIS).  This database will collect information on all U.S. citizens crossing a U.S. border by land.  It co-exists with existing databases that track U.S. citizens' air travel, and for foreigners entering the United States.  Operating together, these databases create a blueprint for a lifetime travel history for anyone crossing a U.S. border.

Naturally, the DHS may share data in the BCIS with federal, state, local, tribal, or foreign governments.  And, although the BCIS is purportedly an anti-terrorist initiative, the DHS may release data to help enforce any civil or criminal law or regulation.  It can even share data with the news media, "when there exists a legitimate public interest in the disclosure of the information."

And of course, the entire system will be exempt from the Privacy Act.  That law would otherwise give you the right to know which law enforcement or intelligence agencies has reviewed your records, along with the right to correct errors or omissions in the database.

Instead of known or suspected terrorists, the government is tracking everyone who crosses a U.S. border.  And since there are no limits to how the government uses the data collected, the BCIS is almost certain to be used for politically motivated surveillance. 

That's particularly true with the new U.S. passports equipped with RFID chips.  The chips will eventually contain the final component of a lifetime travel history: a record not only of U.S. border crossings, but also of border crossings in other countries.  That feature soon will be added to the RFID chip in U.S. passports, according to standards issued by the International Civil Aviation Organization (ICAO).  The ICAO's technical standards for RFID chips in passports specifically reserve memory space for creating a log of border crossings or other situations in which the chip is queried. 

The potential for abuse is obvious.  Imagine that such a system existed now, and the DHS were to release data "in the public interest" that a leading presidential candidate had made previously undisclosed visits to Iran, North Korea, or Cuba.  Not to mention the sort of interrogations that would accompany visits to countries with reputations as tax havens, or that otherwise are "controversial."

Once this system is up and running, if you value your travel privacy, you won't want to use a U.S. passport when you travel internationally.  If you're a U.S. citizen, you must use your U.S. passport when you enter or leave the United States, but you're under no such obligation when you enter or leave other countries. 

Fortunately, it's still perfectly legal for U.S. citizens (and almost anyone else) to obtain a second passport.  The easiest way to qualify for one is based on your marital status, religion, or ancestry. 

A handful of countries also offer "instant" citizenship and passport in return for an economic contribution.  Dominica, St. Kitts/Nevis, and Austria are the only countries with such programs.  In all three countries, you must pass a strict vetting process that includes a comprehensive criminal background check.

For more information on how to obtain a second passport—and preserve your right to travel privately—see http://nestmann.com/passport.html.

Copyright © 2008 by Mark Nestmann

America's "Long Arm" is Very Long Indeed

Have you committed a "tax crime"—or any other crime—that could be prosecuted in the United States?  If you have, you should know that there are few if any practical limits to U.S. jurisdiction if Uncle Sam wants to bring you before its courts. 

Whether it's through an extradition treaty, deportation, or even kidnapping, it's perfectly legal—at least under U.S. law—for U.S. authorities to take "any means necessary" to accomplish this goal.

The best-known method for the United States to bring someone from outside its territorial jurisdiction before its courts is via an extradition treaty.  The United States has extradition treaties in force with over 100 countries.  The largest countries that don't have extradition treaties with the United States are China, Indonesia, Russia, and South Korea. 

Extradition to the requesting country is subject to the laws, procedures, and policies of the requested country.  However, even if there is no extradition treaty in effect—or if the offense with which you are charged (e.g., violations of U.S. economic sanctions against particular countries) isn't covered in the particular treaty—the United States has numerous alternatives to bring you before its courts.

For instance, U.S. authorities might try to nab you when you travel internationally.  Let's say you're a Russian national who travels internationally on their Russian passport.  While you've never set foot in the United States, you have an e-mail account at G-Mail, a U.S.-based e-mail service.  Through this account, you've transacted considerable business with companies in Iran—a country against which the United States has imposed economic sanctions. 

Under U.S. law, using the G-Mail account may well provide U.S. prosecutors with jurisdiction to indict you for violations under the International Economic Emergency Powers Act (IEEPA).  The fact you've never visited the United States won't prevent an indictment.  Nor will it prevent an increasing number of governments from extraditing you to the United States if you set foot there. 

For instance, the U.K.-U.S. extradition treaty eliminates most evidentiary requirements for extradition.  Since the United States now reportedly has access to airline passenger manifests from persons flying into our out of the United Kingdom, it can easily screen these names against those persons it wants to extradite.  Should you fly from Moscow to London, it's possible that when you arrive, police will take you into custody and place you into detention.  Depending on the nature of your alleged offenses, you may—or may not—be able to avoid extradition to the United States.  Welcome to the USA!

The United States can also request that you be deported to its custody, so long as you are present in a particular country, if only for a brief visit.  For instance, when the U.S. Department of Justice wanted to bring offshore tax scammer Marc Harris to the United States from Nicaragua, it didn't use the U.S.-Nicaraguan extradition treaty.  Instead, it issued an Interpol notice, which many of Interpol's 186 members treat as a valid request for provisional arrest.  After arresting Harris, Nicaraguan authorities deported him to the United States, where he was subsequently tried and convicted for tax evasion and money laundering. 

What if you live in a country with no extradition treaty with the United States and never travel outside that country?  In that event, U.S. authorities can carry out an "extraordinary rendition" to bring you into U.S. custody.  This essentially amounts to sending undercover operatives into the country, kidnapping you, and bringing you back to the United States.  Numerous alleged "enemy combatants" now awaiting trial before military tribunals at Guantanamo Bay, Cuba arrived via extraordinary renditions.  And, in case you wondered, the Supreme Court has blessed the practice of kidnapping criminal suspects, even where an extradition treaty is in effect. 

What should you do if you've been accused of a crime in the United States, but live elsewhere?  Certainly, you should hire a competent attorney in your own country to advise you of your options.  One option might be to approach the authorities in your own country and request that you be prosecuted under its laws.  The punishment may be much less than what you would face in the United States, and under most conditions, you can't be extradited for a crime for which you've already been tried. 

Copyright © 2008 by Mark Nestmann

Welcome to the Olympics…and Big Brother

You've realized a lifelong dream…and arrived in Beijing just in time for the opening ceremonies on Friday, August 8. 

No doubt you've brought your suitcases, video recorder, and if you're a bit more adventurous, a Chinese language phrasebook.  But upon your arrival, you'll have an unacknowledged, although very real, presence to accompany you throughout your visit: Big Brother.

This isn't the Big Brother of old, as China displayed to the world at Tiananmen Square in 1989.  No, the new Chinese Big Brother is a lot subtler.

Take the cab ride to your hotel, for instance.  Nearly all of Beijing's taxis are equipped with microphones and video cameras that the Chinese security services police can remotely activate to eavesdrop on passengers.  And please don't discuss politics: if you say something offensive, you could be deported before you even arrive at the opening ceremony! 

Assuming you arrive intact at your gleaming five-star digs, you'll no doubt want to log on to the Internet to catch up with events at home.  With what China calls the "Great Firewall," you might notice that certain Web sites aren't accessible, particularly if they're reporting on events Tibet, human rights violations in China, and the Falun Gong spiritual movement. Other Web sites, such as the BBC or Voice of America sites, are blacked out entirely.

But more likely, you want to read e-mails from home and perhaps correspond with your colleagues at work.  You'll be glad to know that you won't be the only one reading your communications: more than 30,000 full-time security officials monitor e-mail, Internet forums, blogs, and news sites.  And especially if you're staying at one of Beijing's luxury hotels, your room probably comes with a video camera and microphone as well that officials can remotely activate anytime.

Once you leave your room, your belongings probably won't be stolen, thanks to tens of thousands of police stationed throughout the city, and in hotels.  However, when you return, you may notice—or more likely, notice—a few hidden additions to your laptop, cell phone, Blackberry, or other portable electronic device.

In just a few minutes, security officials can sneak into your room and copy all data off any electronic media you've brought with you—your laptop's hard drive, the contact list on your cell phone, etc.  They can also plant software into any electronic device that effectively takes it over once you reactivate it.  From that point forward, even after you return home, Chinese officials can monitor every keystroke on your laptop, your PDA, along with all conversations or text messages on your cell phone. 

How likely is it that you'll be targeted?  Since China requires most visitors to apply for a visa, officials will know in advance that you're arriving.  And, if you're important enough—or if officials believe you possess important information that could be useful to China—you can probably count on the kind of reception that I just described.

Cisco and other U.S. companies manufacture most of the equipment and software China uses for this type of surveillance.  And increasingly, it's being adapted for use in other countries, which means you can expect more and more pervasive surveillance, wherever you travel.

How can you protect yourself?  For once, the U.S. Department of Homeland Security actually has some good suggestions for foreign travel:

"Protective measures should include using designated 'travel' computers, single-use cell phones, temporary e-mail addresses, as well as refraining from communicating with a home organization's information technology systems." 

When you return, simply discard your cell phone and temporary e-mail address.  And "wipe" your computer clean before you leave and after you return, using a utility such as Killdisk (http://www.killdisk.com).

Enjoy the Olympics!

Copyright © 2008 by Mark Nestmann

A Moment of Panic

I pride myself on being prepared for just about anything when it comes to my laptop PC.  I've successfully my data after dropping it on a concrete floor, shorting out the keyboard, and corrupting the hard drive.

But this morning, I came close to panic.  OK, it was panic, although only for a moment.

Yesterday evening, I installed the newest version of PGP Desktop, the flagship personal encryption product from PGP (http://www.pgp.com).  (The PGP line of encryption products originated in the work of legendary programmer Phil Zimmerman, who almost went to jail in the mid-1990s for creating an encryption product the U.S. government couldn't break.)

Everything went smoothly.  After installing the program, I began what PGP calls "Whole Disk Encryption."  That means that the laptop will start up only after you enter the correct PGP "passphrase" into a dialog box. 

No problem there.  I created a passphrase that was easy for me to remember, and hopefully, hard for anyone else to guess.  Then I did something you're not supposed to do—I wrote down the passphrase on a piece of paper in case I forgot it.  My intention was to shred that piece of paper this morning, after making certain that I had memorized the passphrase.

This morning, after a mug of the overly-strong coffee I'm so fond of, I sat down at the laptop and turned it on.  As I expected, the PGP dialog box appeared and asked me for the passphrase.  I entered it, but the program told me I had entered in an incorrect passphrase.

That's when the moment of panic set in.  I typed every conceivable variation of the passphrase I could think of, at least 30 in all.  None of them unlocked my laptop. 

I knew from reading the PGP user guide that if I couldn’t recall the exact passphrase, the only choice I would have would be to reformat my entire hard drive.  S**t!!!!

And remember that piece of paper?  Apparently, the passphrase I wrote on it wasn't the one I actually used to encrypt the hard disk.  Double s**t! 

What to do?  The only alternative was to keep trying different passphrases until one opened up the disk.  Then I remembered that I had considered—and I thought rejected—a slightly shorter passphrase than the one I actually used to encrypt the hard drive.  Could I have mistakenly used that one?

I entered that combination of letters, numbers, and symbols on the keyboard and briefly held my breath.  The hard drive opened up normally, and I was back in business.

The moral of this story, of course, is do as I say, not as I do, to wit: DON'T FORGET YOUR PASSPHRASE!! 
And of course, don't panic, unless there's a very good reason. 

Copyright © by Mark Nestmann

Feds to U.S. Border-Crossers: We Own Your Laptop

It's bad enough that when you cross a U.S. border, you must consent to an intrusive search of your luggage.  But now, courtesy of a decision from a federal appeals court, the government also has the right to copy everything on your laptop—and use it for whatever purpose it seems fit.

I wrote about an earlier decision along these lines over a year ago.  (Click here to read the posting).   As I wrote then, the ways that this new authority can be misused are too numerous to count—whatever information you carry with you on your laptop—banking records, client data, “adult” videos, you name it—now, in effect, must be shared with the U.S. government.

But now it's even worse: the 9th Circuit Court of Appeals has ruled that customs officials don't even need "reasonable suspicion" (much less "probable cause") to "search a laptop or other personal electronic storage devices at the border."  That means in addition to your laptop, customs officials can search and copy data from your cell phone, Blackberry or any other electronic device without any evidence you've done anything wrong.

A search of a laptop is far more intrusive than a search of your luggage.  In some ways, it's even more intrusive than a body cavity search, which customs officials do require "reasonable suspicion" to conduct. 

Your body cavities may (or more likely may not) reveal any contraband.  But examining the data on your laptop may well reveal a detailed picture of your friends, your family, your professional associates, your interests, your financial status, and possibly much more.  As one attorney noted, "It really is like looking into someone's mind, rather than looking into a box or a folder or a purse."

One way to protect yourself from this type of intrusion is to encrypt all the data on your laptop, or even the hard disk itself, using a program like PGP Desktop (http://www.pgp.com). 

Unfortunately, that may not be an ideal solution, because customs officials may demand that you decrypt any encrypted files before they return your laptop.  If you refuse, they can confiscate the laptop and/or detain you until you agree to provide access to the unencrypted files.

A better solution may be to copy all the data on your laptop to a USB stick and send it via a courier service to your international destination.  Encrypt the data, of course, before you send it.  Then securely "wipe" any confidential information off your hard drive, along with the "free space," again using a program like PGP Desktop. 

If you carry your laptop through Customs, be sure to "sanitize" it.  First, encrypt and copy your data to a USB stick, then send it via courier to your destination.  Then, use a utility like Killdisk (http://www.killdisk.com) to securely wipe everything on your hard drive.  Then reinstall the operating system according to the instructions in Killdisk or whatever utility you use for this purpose.  (There are other possible “sanitation” solutions but none as good as this one.) 

If Customs asks you to inspect your laptop, let them.  The inspector won’t find anything but the operating system and standard system files.

(For more suggestions on protecting your privacy and wealth, click here.)

Copyright © 2008 by Mark Nestmann

Warning: Your Cat May Make You a Terrorist Suspect

In these halcyon post-9/11 days, we've learned apparently innocent actions can instantly convert us from "law-abiding Americans" into "terrorist suspects."

Just a few examples will suffice:

• Your reading habits make you a terrorist suspect. A senior at the University of Massachusetts came under investigation after he made an inter-library loan request for a copy of Mao Tse-Tung's paean to Communism called "The Little Red Book."
• Wearing the wrong shirt makes you a terrorist suspect.  A man trying to board a plane in New York was detained due to his T-shirt, which bore the slogan "We Will Not Be Silent" in both Arabic and English.
• Paying off your credit card bill makes you a terrorist suspect. Walter Soehnge, of Providence, R.I., found himself under suspicion of terrorist activity because he paid off a US$6,500 credit card bill.  Because this was much larger than his normal monthly payment, his bank froze his account and reported the payment to the Department of Homeland Security as a potentially "terrorist-related transaction." 

Well, we can now add another notable indicator of terrorist activity to this list: your pet, or in this particular case, your cat.

In this age of heightened awareness of terrorism, we're told we can't afford to let any possible terror activity go undetected.  One surveillance initiative is placing sensitive radiation detectors on interstate highways.  After all, you never know when Osama might be tooling down the highway with the ingredients for a "dirty bomb" in his turban.

The radiation detectors are so sensitive, in fact, that they recently uncovered an unlikely terrorist suspect: someone's pet cat.

Here's the story: a few months ago, police on Interstate 5 in the state of Washington were monitoring traffic for radiation emissions.  A vehicle whizzed by and the detector "alerted" to the presence of radiation. 

The police gave chase and pulled over the offending vehicle a few miles south of Bellingham.  A cursory search of the car revealed nothing of interest—with the exception of a "radioactive cat." 

The cat, it turned out, had recently undergone radiation therapy for cancer.  The tiny amount of residual radiation was high enough that it set off the detector. 

We're living in a very different world after the events of 9/11/01.  And the scary thing is, it's hard to predict what any of us might do create a terrorist profile for ourselves. 

In the case of the terrorist cat, the driver was released after he showed documentation of the radiation treatment.  I suspect he may have been grateful, after some reflection, that he had not recently undergone radiation treatment for say, prostate cancer. 

Copyright © 2008 by Mark Nestmann

Uncle Sam Doesn't Want Anyone to Visit Cuba

One of the best-kept secrets in America's arsenal of financial sanctions is the U.S. Treasury Department's Terrorist Watch List.  It's maintained by the Treasury's Office of Foreign Assets Control (OFAC) to enforce economic and trade sanctions against more than a dozen countries.  (I wrote about this list here.)

One of those countries is Cuba. Under a series of executive orders and laws enacted by Congress, it's illegal for a U.S. citizen to travel to Cuba, without a "license" issued by OFAC.  It's also illegal for a U.S. company to do business with Cuba without a license, except in narrowly defined circumstance. 

However, these laws and regulations have no legal effect in other countries.  If someone, say, in Spain, wants to travel to Cuba, there's no violation of U.S. law, since the United States has no jurisdiction over Spain.

Only, it does, according to OFAC.  In October, OFAC shut down 80 Web sites owned by a British travel agent named Steve Marshall who sells vacations to Europeans.  One of the places to which Marshall offers vacations is Cuba. 

This was justified, according to OFAC, because Marshall's company "had helped Americans evade restrictions on travel to Cuba" and was "a generator of resources that the Cuban regime uses to oppress its people."

Marshall says he didn't market Cuban vacations to Americans, "because they can't travel there, anyway."  But his real mistake was using a U.S.-based domain name registrar for his Web sites.  This gave OFAC the ability to contact the registrar, eNom, and order the company to pull the plug on Marshall's Web sites.  Given the fact that failure to comply with OFAC regulations can be punished with a 30-year prison sentence, a US$5 million criminal fine, or a civil penalty of up to US$1 million, eNom quickly complied.

Fortunately, Marshall was able to re-register his Web sites with a European registrar, although he had to rename most of them with the suffix ".net" rather than ".com." 

But there's a larger issue at stake.  OFAC shut down Marshall's business without warning, without a hearing, resulting in hundreds of thousands of dollars of lost revenues.  Not exactly the "American way" we read about in civics textbooks.

However, it could have been worse.  If Marshall had established a U.S. bank account, or maintained any other asset in the United States, the U.S. bank or custodian would have been obliged to freeze it—and turn the proceeds over to OFAC. 

Are you on the OFAC terrorist watchlist?  You can find out for yourself by visiting OFAC's list of "specially designated nationals" here.

If you're on the list, though, don't count on getting off anytime soon.  That's because the only way to get off is to ask OFAC to remove you from the list.  This is an administrative determination—you have no right to a court hearing to determine if you should have been put there in the first place.

In other words, the same bureaucrat who put you on the watch list in the first place may be the one who you ask to take you off of it.  Good luck…

(For more information on emergency financial controls administered by OFAC and other government agencies, click here.)

Copyright © 2008 by Mark Nestmann

Practice these "Good Housekeeping" Habits to Protect Your Encrypted Data

In my most recent blog entry, I described a fundamental vulnerability in several popular disk encryption technologies. 

This vulnerability, which researchers have dubbed the "Cold Boot Attack," can leave your encrypted data vulnerable to attack and exposure.  Any information remaining in your PC's memory—including your encryption keys and passphrases—may be recovered.

Fortunately, you can take several precautions to avoid having your data compromised.  They're suggested by PGP, the company that produces PGP Whole Disk Encryption, my top-rated encryption product:

• When possible, place computers in hibernation instead of sleep mode.  Hibernation mode (at least in the case of PGP) removes encryption keys from computer memory.
• Shut your PC down a few minutes before you leave your office or present it for physical inspection (e.g., at a U.S. border crossing).  This gives the memory chips in your PC time to cool off and the contents of the memory to dissipate, lessening your susceptibility to this type of attack.
• If you use PGP Whole Disk Encryption, use PGP Virtual Disk (a part of the program) to prevent this attack.  Keep your confidential files in a virtual disk.  When you unmount your virtual disk, your data is secure from the Cold Boot Attack.  Configure PGP Desktop to unmount virtual disks if the computer goes into sleep mode.
• Finally, never "cache" your encryption keys.  PGP and other popular encryption programs permit you to store your encryption keys in your PC's memory so that you don't have to type the passphrase each time you open an encrypted file. 

I should emphasize that this is a hardware issue—it has nothing to do with the strength or weakness of encryption programs.  But by practicing these encryption "good housekeeping" practices, you can insure your encrypted data remains secure.

Copyright © 2008 by Mark Nestmann

Think Encryption Can Protect Your PC's Secrets? Think Again…

One of the best ways to protect the data on your home or office PC, and—especially—your laptop is to encrypt it.

Encryption is a mathematical process that converts your e-mail messages, your disk files, or even your entire hard drive into unreadable gibberish.  Only you—and the intended recipients of your encrypted messages—can decipher the gibberish.

Encryption programs are now available that even the super-computers used by national intelligence agencies cannot decipher messages created with them, at least not without an exhaustive effort.

Unfortunately, recent discoveries by computer security researchers have uncovered a fundamental vulnerability in several popular disk encryption technologies.  This vulnerability can leave your encrypted data vulnerable to attack and exposure.  Basically, what it involves is harvesting your encryption keys from your PC's memory chips, even if your system is turned off.

In a paper published last week, security researchers affiliated with Princeton University announced they had discovered a way to do this, and thus circumventing various disk encryption products.  The researchers say their technique works against Apple's FileVault, the BitLocker Drive Encryption feature included in some versions of Windows Vista, the open-source product TrueCrypt, and the dm-crypt subsystem built into newer versions of Linux.  In theory, the attack would also work against my #1 recommended encryption program—PGP Whole Disk Encryption. 

To succeed in what the researchers call the “Cold Boot Attack,” an attacker must have physical access to your PC or laptop while it is running or within a few minutes of shutting down.  The Princeton researchers discovered that it takes a few minutes after you shut off your PC before the data in your PC's RAM chips is actually gone.  During this period, any information remaining in RAM—including your encryption keys and passphrases—may be recovered.

Once upon a time, computer hardware manufacturers assured us that once you turned your PC off, all the data in its memory (RAM) instantly disappeared.  Only, it turns out this isn't true. 

Here's an example of how your data might be compromised.  You're on a flight from London to New York.  Just before landing, you turn off your laptop, taking care to insure that all your confidential data is encrypted.  You're extra careful, since you know that U.S. customs officials now have the authority to confiscate laptops without probable cause of any wrongdoing.  Once they've done so, they can copy the contents, and use that information for whatever purpose they see fit. 

You enter the customs queue and you're pulled aside for a secondary inspection.  The customs agent asks to see your laptop.  He inserts a USB drive into it and turns on the power.  Software on the USB drive identifies the encryption keys and reconstructs them, along with your passphrase.  Now the agent can read every encrypted file on your laptop. 

I should emphasize that this is a hardware issue—it has nothing to do with the strength or weakness of encryption programs.  But it means that an attacker could compromise all encrypted data on your PC, even if it's turned off!

Fortunately, there are several precautions you can take to avoid having your data compromised in this manner.  I'll describe them in my next blog entry.

Copyright © 2008 by Mark Nestmann