International travel and data security

Information securityInformation security

It is very common these days for UVic faculty and staff to travel abroad with electronic devices such as laptops, tablets, cell phones, USB drives, and other digital storage devices. If you are traveling with an electronic device, you may have to deal with border officials at some point.

Privacy and security at border crossings

Some foreign governments retain the right to seize travelers’ electronic devices and review their contents. At border controls, officers have widespread powers to stop and search people, and examine their baggage and other possessions including devices such as laptops and smartphones. Failure to unlock an electronic device may cause you to be detained or refused entry to the country.

International travel best practices

  • Leave any unnecessary electronic devices at home
  • Encrypt your device
  • Passphrase-protect your device
  • Use different passphrases for different accounts; if you are forced to disclose a password it does not provide access to all of your services
  • Do not travel with any unnecessary data that may be subject to search. Use VPN to access Connect or Department File Storage remotely
  • If you are asked to unlock or provide a passphrase, inform the border agent that the device contains confidential UVic information. If the official persists, comply with the demand, but report the search of your device/accounts to your supervisor and the CPO (privacy@uvic.ca) as soon as possible.

For helpful tips and videos on international travel with electronic devices, see the Electronic Devices Privacy Handbook: A Guide to Your Rights at the Border on the British Columbia Civil Liberties Association (BCCLA) website.

Frequently asked questions

I am travelling with an electronic device I use for work. What do I need to know?

Recently, the US and UK have increased security measures on electronic devices for incoming flights. Travelers on flights coming from several countries will face restrictions on large electronic devices, including, but not restricted to, over-sized smartphones, tablets, e-readers, game consoles and laptops.

Before your trip:

  1. Ensure your devices are clean and empty.
  2. If the devices you want to take does contain large amounts of UVic confidential/sensitive information, consider leaving them behind.
  3. Securely store the files you won't need while you're away in a secure location (i.e., Connect or departmental file storage) and remove them from your device.
  4. Check the most recent guidelines for the country you are visiting - not all countries allow encryption and some have restrictions on portable electronic devices in your carry-on baggage.

Do I have to show my mobile device to a security officer if there is private information on it?

In many countries, customs or other law enforcement officials are authorized to require travellers to unlock a device using a password or biometric identifier (Touch ID or Face ID), and they may ask to examine what is stored within a device, such as photos, files, downloaded e-mails and other media. 

If the device contains work-related personal information, UVic employees should first notify the official that the device contains confidential university information.

If the official is persistent, employees may comply with the demand. However, they should make a reasonable effort to keep the device in sight at all times. After the device is returned, change the password  immediately and report the incident to the Chief Privacy Officer (cpo@uvic.ca) as soon as possible.

Failure to unlock an electronic device may cause you to be detained for further inspection or refused entry to the country.

How can I avoid issues when travelling with my mobile device?

The best way to avoid issues is to remove any encryption software from the device prior to travelling. Please note: you can only do this if you remove all confidential information fromt he device as well. It is much more secure to log in remotely to UVic servers than to carry confidential information with you. However, if you must have confidential information saved on your device, then it must be encrypted.

Will the electronic ban in the US and the UK affect me?

Certain commercial flights arriving in the United States and the United Kingdom are now subject to restrictions for carry-on electronic devices.

If you are travelling from any of the affected countries below, it is very likely that you will be impacted by the electronic device ban. To ensure that you are following the most up-to-date guidelines, please refer to the Commercial flights to the US Fact Sheet and the Commercial flights to the UK Overview.

Impacted International Flights bound for the US or UK originate from airports in the following countries:

Country Travel to US affected? Travel to UK affected?
Egypt YES YES
Kuwait YES NO
Lebanon YES YES
Morocco YES NO
Qatar YES NO
Saudi Arabia YES YES
Tunisia NO YES
Turkey YES YES
United Arab Emirates YES NO

If you have to travel with your electronic device in a checked bag, put it in a hard-shell case and bury it in the middle of your suitcase. If the device stores personal information, make sure it is encrypted. It is recommended to get a TSA-Approved lock to protect from theft. If possible, take an alternative inexpensive laptop or tablet instead and keep sensitive documents on an encrypted USB and not on the device.

If you choose to only travel with a standard sized smartphone in order to ensure that you can take it in the cabin with you, please be aware that it must be encrypted if it stores any information – including emails – which contain personal information. You are still also at risk for search by border officials and you should be prepared to deal with this if necessary.

If you are travelling with an encrypted device, special considerations may apply. View the Canadian export and foreign import controls on encryption products on the Security Considerations for International Travel with Mobile Devices [PDF] document.

What are the Canadian export controls on encryption products?

Because encryption products can be used for illegal purposes, including terrorist activity, Canada restricts the export of some encryption products to the following countries: Cuba, Iran, North Korea, Sudan, and Syria. Travellers visiting these countries may not have encryption products installed on their computers unless they have a special export license; check with Desktop Support Services or the Computer Help Desk for more details.

What are the foreign import controls on encryption products?

Some countries ban or severely regulate the import and use of encryption products.

Under a set of rules known as the "Wassenaar Arrangement”, travelers may freely enter a participating country with an encrypted device under a "personal use exemption" as long as the traveler does not create, enhance, share, sell or otherwise distribute the encryption technology while visiting.

The countries that support the personal use exemption include: Argentina, Australia, Austria, Belgium, Bulgaria, Canada, Croatia, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Japan, Latvia, Lithuania, Luxembourg, Malta, Netherlands, New Zealand, Norway, Poland, Portugal, Republic of Korea, Romania, Slovakia, Slovenia, South Africa, Spain, Sweden, Switzerland, Turkey, United Kingdom and the United States.

The following nations do not recognize a "personal use exemption". Before traveling to these countries with an encrypted device, travelers will need to apply to the specified governmental agency for an import license:

  • Belarus - a license issued by the Belarus Ministry of Foreign Affairs or the State Center for Information Security of the Security Council is required.
  • Burma (Myanmar) - a license is required, but licensing regime documentation is unavailable.
  • China - a permit issued by the Beijing Office of State Encryption Administrative Bureau is required. The laws in China vary from province to province where the customs officers or border guards make their own interpretation of what encryption means.
  • Hungary - an International Import Certificate is required.
  • Iran - a license issued by Iran's Supreme Council for Cultural Revolution is required.
  • Israel - a license from the Director-General of the Ministry of Defense is required. 
  • Kazakhstan - a license issued by Kazakhstan's Licensing Commission of the Committee of National Security is required.
  • Moldova - a license issued by Moldova's Ministry of National Security is required.
  • Morocco - a license is required.
  • Russia - licenses issued by both the Federal Security Service (Federal'naya Sluzhba Bezopasnosti - "FSB") and the Ministry of Economic Development and Trade are required. License applications should be submitted by an entity officially registered in Russia. This would normally be the company that is seeking to bring an encryption product into Russia.
  • Saudi Arabia - it has been reported that the use of encryption is generally banned, but research has provided inconsistent information.
  • Tunisia - a license issued by Tunisia's National Agency for Electronic Certification (ANCE) is required.
  • Ukraine - a license issued by the Department of Special Telecommunication Systems and Protection of Information of the Security Service of Ukraine (SBU) is required.

In addition to import controls, some countries have regulations restricting the use of encryption. The most prominent are France, South Africa, China and Russia.

Since laws can change at any time, it's best to check before traveling to ensure that you have the most up-to-date information.