Eluding Surveillance and Preparing Your Mobile Phone for Confiscation

Imagine you're about to walk into a dicey situation. Maybe you're an activist attending a public demonstration. Maybe you're a journalist crossing a national border. Maybe you’re a civilian citizen about to be accosted by ICE. Maybe you're meeting with a vulnerable client, volunteering at a community event, or entering a government building. Chances are nothing unusual will happen, but if your phone were lost, stolen, or temporarily taken from you, you'd probably want to take reasonable precautions.

Shut Down Your Phone

Yeah, it’s one of the most effective things you can do and it takes less than a minute. Here’s why: when your phone is shut down, it’s higher communication functions have been suspended. A powered-off phone is different from a sleeping phone. When the screen is off but the phone hasn't been shut down, it's still actively communicating with cell towers, Wi-Fi networks, Bluetooth devices, and other services. The safest phone is one that’s turned off.

Okay, so why do we want to turn off your phone? It seems like a massive inconvenience.

Well, that’s the point.

When a phone’s on, it’s communicating, and it can be detected by Stringrays — fake cell towers setup by law enforcement that trick your device into joining it, where the officers can harvest your location and IMEI number. Civil liberties groups have long warned that these devices can collect identifying information from many bystanders (not just the person or persons being investigated) and privacy advocates have raised concerns about their potential use around demonstrations and other public gatherings. Turning off your phone reduces the risk of wireless electronic surveillance through the use of a Stingray.

Whenever you’re walking into a dicey situation, always assume that the communication networks are being monitored and exploited. Turn off your device.

Use a Faraday Bag

Now, just because your phone is off, that doesn’t mean it’s not communicating.

For example, iPhones can continue supporting Apple's Find My Network for a period after being powered off, using low-power Bluetooth. Some devices also support NFC features (such as transit cards) while "off." Those features are different from remaining attached to the cellular network, but they can still put you at risk. Further, although your phone might be turned off, what about your smart watch? Or your smart ring? A fitness tracker? How do you turn those off?

Next, throw your turned-off phone and these devices into a Faraday bag. A Faraday bag is a pouch lined with special material that blocks radio signals. While your devices are inside, they can't communicate with nearby cellular towers, Wi-Fi networks, Bluetooth devices, or other wireless systems. Faraday bags are relatively inexpensive and easy to purchase; it’s a great safeguard to carry around.

Dispelling a Myth: Ripping Out the SIM Card

Years ago, people were coached to remove the SIM card from their phones for a similar reason. That advice has largely become outdated. Many modern phones don't have removable SIM cards anymore — they use eSIMS — and taking one out does little to protect the information already stored on the device. A powered-off phone inside a Faraday bag is a much more complete way to prevent wireless communication until you're ready to use it again.

Powering on The Phone Forces It Into a Unique State

Believe it or not, your phone is especially secure after restarting. Security pros call this the "Before First Unlock" state. True, the name’s a little clunky, but it describes what's happening. Although the phone has started up, it hasn't received your passcode. Until it does, some of its most sensitive information remains protected behind additional layers of security.

You’ve probably noticed this before. If you try to unlock your phone. Your fingerprint won't work. Face recognition won't work either. The phone insists on your passcode before anything else. And that's intentional.

That “Before First Unlock” state offers you a slew of security advantages.

• Access to your device requires your full passcode. Fingerprint and facial recognition are disabled until you enter your passcode after a restart.

• It keeps the strongest encryption protections in place. Some of the keys needed to unlock sensitive information aren't made available until you've entered your passcode.

• Makes stored data significantly harder to access. Photos, messages, documents, passwords, and other protected data remain encrypted until after the first successful unlock.

• Reduces the effectiveness of many forensic extraction techniques. Commercial forensic tools generally face a much more difficult challenge when a device is still in the Before First Unlock state than when it has already been unlocked since boot.

• Protects secure credentials. Passwords, authentication tokens, and cryptographic keys stored by the operating system are generally less accessible before the first unlock.

• Disables biometric authentication. Someone cannot unlock the phone using your fingerprint or face until you've first entered your passcode.

• Requires user knowledge instead of user presence. The phone demands something you know (your passcode) rather than something you are (your fingerprint or face).

• Provides a stronger starting point if the phone is lost or seized. If someone obtains your device while it's still in the Before First Unlock state, they have fewer options available than if you'd already unlocked it that day.

Combined with those self-destruct settings that I wrote about the other week, a restarted phone offers the highest degree of protection at a moment of seizure, and in the United States, this moment (starting up a turned off phone) intersects with a citizen’s Constitutional Rights and case law.

The Sealed Container

Smart phones have received significant 4th Amendment protections. In Riley v. California, the U.S. Supreme Court held that police must obtain a warrant before searching the contents of a cellphone seized during an arrest. The Court recognized that modern phones contain vast amounts of personal information unlike ordinary physical containers.

Still, even with a warrant, obtaining access to the data is a separate legal question. Courts have had to decide whether someone can be compelled to unlock the device. Many have concluded that forcing someone to reveal or enter a memorized passcode can implicate the 5th Amendment's protection against compelled self-incrimination because it requires revealing the contents of one's mind. At the moment, there is no single nationwide Supreme Court rule that resolves this.

But biometrics are treated differently. They’re considered physical characteristics, not knowledge, and historically, courts have been more willing to permit compelled use of a fingerprint or face to unlock a phone, especially when authorized by a warrant. That's why privacy advocates have long recommended relying on a strong passcode instead of biometrics in situations where compelled unlocking is a concern, and if the phone is in that “Before First Unlock” state, it can’t be opened without something you know — your passphrase — and not just with something you are.

It’s Preparation — Habits — Not Magic

None of this is arcane magic, forbidden knowledge. In fact, it’s ridiculously simple.

Restarting your phone, powering it off, and isolating it from wireless networks using a Faraday bag won't make it impossible for a determined investigator to examine under every circumstance. What these steps do is reduce unnecessary exposure. They buy you time. They limit opportunities for wireless communication. They make it more difficult for aggressors to use your phone and data against you. They help protect you from wrongful search and seizure.

It’s all about habits. Most of us already have small routines before leaving home. We check that we've locked the front door. We grab our keys. We make sure we have our wallet. If you're heading into a situation where you believe your electronic devices deserve a little extra protection, add one more habit to that routine.

Restart your phone and leave it locked/power it off if you won't need it immediately, and place it—and any other wireless devices you're carrying—into a Faraday bag.

It's a quiet and uncomplicated, but it might be the smartest security decision you can make all day.

R