9 things feds should know about secure international travel

All staff members planning to travel overseas should be required to attend an international travel security briefing prior to departure to increase their awareness of information security threats and rules for protecting electronic information when traveling outside the United States. The briefing should include the following points:

1. U.S. travelers are targets. Travelers need to know that in light of current worldwide political and economic instability, the fact that they are American citizens and, in particular, U.S. government employees or contractors, makes them a target for exploitation. This applies particularly to the information residing on their electronic devices as well as the data communicated by or to the traveler. Furthermore, in third world countries, a laptop computer is a sign of wealth and carrying one may place employees at risk.

2. Basic rules for international travel. Travelers should expect that information transmissions are being intercepted and read at any location where networks are controlled by another government. Foreign network providers can disable mobile device encryption and then turn it back on after information is intercepted. Travelers should avoid processing and transmitting sensitive information, if possible.

Related: Traveling out ofr the country? Here's how to manage the cybersecurity risks

3. Protection of portable devices. Travelers must be informed about threats to and protection of the mobile device(s) they will be carrying; in particular, laptops, personal digital assistants (PDAs) and cell phones. Information stored on mobile devices may be exposed to increased risk during foreign travel. Travelers especially must protect sensitive information. The easiest and most effective way to protect information during foreign travel is to leave mobile communication devices at home if they are not essential to their mission.

4. Threats to mobile, wireless devices. These devices send and receive data via wireless network signals beamed from orbiting satellites and ground-based cellular relay towers. When overseas, foreign communication networks can intercept these signals. Travelers should assume that all forms of communication with mobile wireless devices are monitored and subject to compromise. Hacker software can also be used to locate and connect to vulnerable Bluetooth-enabled cell phones, allowing address book information, photos, calendars, and SIM card details to be downloaded, long-distance phone calls to be made using the hacked device and cell phone bugging.

5. Wireless device countermeasures. Travelers should be instructed to power-off mobile devices when not in use and that Bluetooth functions should only be used if absolutely necessary. When not in use, travelers should remove the battery and SIM card, and store them separately from the device. Additionally, organizations should employ strong passwords, set short idle timeout periods, set devices to lock when returned to the holster and ensure that information stored on the device is encrypted.

6. Physical security measures. Travelers should be briefed on the need for constant physical control of portable devices. For instance, when passing through an airport, they should not send a laptop PC through the scanner until reaching the front of the line, in order to keep it under observation. They should avoid checking a laptop with baggage or leaving it unattended in a hotel room. Anywhere facilities are controlled by another government, travelers should expect tampering with unattended electronic devices. Rooms are accessible by hotel staff, as are hotel safes. In many instances, local authorities can quickly gain access to an unoccupied hotel room. When traveling internationally with a local (removable) hard drive, a CD or an encrypted USB thumb drive, travelers should keep them separate from the laptop. Device tampering is often nearly impossible to detect, so devices used for international travel should not be used domestically.

7. Compromising emanations. Travelers should also be aware that electronic signals coming from the devices they are using can be intercepted and read under certain circumstances — from adjoining hotel rooms, for example.

8. Kiosk/Internet café threats. Travelers must be aware that public Internet kiosks and cafes are breeding grounds for malicious software that can capture private content (passwords, bank account or credit card information, phone numbers, names, etc.), and may be controlled by unknown groups who have malicious intentions. Travelers should be instructed to never use them for official or confidential personal business.

9. Incident response. Travelers must know the policy and method for reporting incidents as soon as they are known. Any suspected tampering, unauthorized use, loss or theft of IT media must be reported to the agency’s incident response team immediately.

Advice for agencies

Organizations should designate specific laptops and PDAs to be used only for International travel. All devices should be encrypted, have up-to-date antivirus definitions and patches, and should be scanned before departure and upon the traveler’s return. Policies should require management approval to store any sensitive information on international-use devices. Travelers should be required to report all airline connections and side trips associated with their travel. Finally, when a user loses physical control of a device during international travel, organizations should destroy the device upon return.