Encrypted Mobile Devices & International Travel Restrictions

DISCALIMER: All Faculty and Staff must contact the countries that their planning to visit or to work when carrying UBC provided encrypted laptop and mobile computing devices. The information herein is for reference purposes only.

Security Considerations for International Travel With Mobile Devices

There are some additional factors to consider if you are traveling internationally with encrypted laptops.

The USA and Canada government export regulations includes an exemption for the personal use of encryption technology on portable devices except if the travel is to one of the countries that the US and Canada has designated as supporting terrorism (i.e. Cuba, Iran, North Korea, Sudan, and Syria). You must remove any encryption technology if you will be traveling to these countries.

Some countries have their own regulations restricting the use of encryption. The most prominent are France, South Africa, China and Russia. For more information follow this International Trac Canada link: Export permits for cryptographic items

Providing Passwords to Customs and Border Guards

USA and Canada

A number of countries have laws that require you to produce a password if requested by law enforcement officials. In some of these countries, refusal to provide the password can result in arrest and time in jail. USA and Canada Customs occasionally searches laptops when a traveler returns to the country. They have been known to retain laptops for further analysis if a traveler refuses to unlock the system. It is advisable to unlock the laptop when asked by the Custom officers.

International Countries

With respect to the necessity of providing a password to a border guard, the answer is not clear. It would depend on the circumstances, as well as the laws of the jurisdiction. As a practical matter, though, in most countries border guards have extensive powers of search and seizure. If you do not provide your password, the device may be seized and you may also be denied entry if you are trying to enter a foreign country. UBC employees must therefore minimize the amount of personal information they carry outside the country. If asked for the password, personnel should advise the agent that the device contains confidential material for the University. If the agent is adamant in obtaining the password then provide it to them. If possible keep the laptop in sight at all times. If you are unable to keep the laptop in sight, note how long it was out of your sight (and possession) and report it upon return to UBC to Larry Carson, Associate Director Information Security Program, at larry.carson@ubc.ca or 604 822-0773.

Frequently Asked Questions for International Travel

May I take my encrypted laptop when traveling internationally?

It depends. Because encryption products can be used for illegal purposes, including terrorist activity, the United States and many of the countries that you may visit may ban or severely regulate the import, export and use of encryption products.  So, taking your laptop with encryption software to certain countries without proper authorization could violate U.S. and Canada export laws or the import regulations of the country to which you are traveling, and could result in your laptop to be confiscated, and you may be subjected to fines or other penalties.

Over the past fifteen years, a group of nations negotiated a set of rules attempting to facilitate traveling with encryption software known as the "Wassenaar Arrangement."  One of its provisions allows a traveler to freely enter a participating country with an encrypted device under a "personal use exemption" as long as the traveler does not create, enhance, share, sell or otherwise distribute the encryption technology while visiting.

The countries that support the personal use exemption include:  Argentina, Australia, Austria, Belgium, Bulgaria, Canada, Croatia, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Japan, Latvia, Lithuania, Luxembourg, Malta, Netherlands, New Zealand, Norway, Poland, Portugal, Republic of Korea, Romania, Slovakia, Slovenia, South Africa, Spain, Sweden, Switzerland, Turkey, United Kingdom and the United States.

Although the Russian Federation and the Ukraine agreed to many of the Wassenaar Arrangement's provisions, they currently do not permit personal use exemptions.

What U.S.A / Canada export controls do I need to satisfy when leaving the country with my encrypted laptop?

The encryption functionality within McAfee's Data Protection Suite, has been granted an "ENC/Unrestricted" license exception with the U.S. Department of Commerce. Dell/Credant encryption falls under §742.15(b) of the U.S. Export Administration Regulations (EAR) ("Encryption registration required, with classification request or self-classification report, for mass market encryption commodities, software and components with encryption exceeding 64 bits.")  It is categorized as Mass Market with an Export Control Classification Number (ECCN) of 5D992.  Dell/Credant's Encryption Registration Number (ERN) is R100449."

In both cases, this exception allows us to transport or ship a University-owned or personally-owned computer that has one of our approved encryption products installed to any country as long as the computer remains under our effective control, EXCEPT for the following countries defined in the Department of Commerce's Export Administration Regulations:

• Cuba
• Iran
• North Korea
• Sudan
• Syria

If you must travel to one of the five embargoed countries, you may be able to obtain the appropriate export license, but the process can take, on average, a ninety days for review.  The Department of Commerce's Bureau of Industry and Security and the Office of Foreign Assets Control (OFAC) within Dept. of Treasury accept applications for licenses to export encryption products and technologies.

If you cannot obtain an export license, see the section below regarding your options if you cannot satisfy encryption export or import controls.

What countries have encryption import restrictions and how can I obtain an import license?

The following nations, including two Wassenaar signatories indicated by an asterisk (*), do not recognize a "personal use exemption".  Before traveling to these countries with an encrypted laptop, you will need to apply to their specified governmental agency for an import license:

• Belarus - a license issued by the Belarus Ministry of Foreign Affairs or the State Center for Information Security of the Security Council is required.
• Burma (Myanmar) - a license is required, but licensing regime documentation is unavailable. Contact the US State Department for further information.
• China - a permit issued by the Beijing Office of State Encryption Administrative Bureau is required. You can either apply for the permit on your own. The laws in China vary from province to province where the customs officers or border guards exact their own interpretation of what encryption means. It is advised that your travel laptop is not encrypted but carry an encrypted USB Key. Do not forget your pass phrase when asked to decrypt.
• Hungary - an International Import Certificate is required. Contact the US State Department for further information.
• Iran - a license issued by Iran's Supreme Council for Cultural Revolution is required.
• Israel - a license from the Director-General of the Ministry of Defense is required.  For information regarding applicable laws, policies and forms, please visit the following website: http://www.mod.gov.il/pages/encryption/preface.asp.
• Kazakhstan - a license issued by Kazakhstan's Licensing Commission of the Committee of National Security is required.
• Moldova - a license issued by Moldova's Ministry of National Security is required
• Morocco - a license is required, but licensing regime documentation is unavailable. Contact the US State Department for further information.
• Russia - licenses issued by both the Federal Security Service (Federal'naya Sluzhba Bezopasnosti - "FSB") and the Ministry of Economic Development and Trade are required. License applications should be submitted by an entity officially registered in Russia. This would normally be the company that is seeking to bring an encryption product into Russia.
• Saudi Arabia - it has been reported that the use of encryption is generally banned, but research has provided inconsistent information.  Contact the US State Department for further information.
• Tunisia - a license issued by Tunisia's National Agency for Electronic Certification (ANCE) is required.
• Ukraine - a license issued by the Department of Special Telecommunication Systems and Protection of Information of the Security Service of Ukraine (SBU) is required.

Since laws can change at any time, please check with the US State Department before travelling internationally to ensure that you have the most up-to-date information.  Additional information about international encryption controls can be found at the following websites:

Crypto Law Survey

Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Good and Technologies

What can I do if I cannot satisfy encryption export or import control requirements?

If you are not able to meet the import or export requirements for a country you are about to visit, we recommend one of the following two options:

• If you are a member of the University's faculty or staff, you can request a "loaner laptop" from your IT Department.  A loaner laptop is a computer that is preloaded with standard University software, but does not contain data that could put the University at risk if the laptop is lost or stolen. 
• Remove the encryption software from your laptop prior to traveling.  PLEASE NOTE - Any confidential or highly confidential information found on your laptop must be removed before your hard drive is decrypted per the University's Information Security Policy.