Customs erased photos from computer

[MelissaB]

A relatiave traveled home for Thanksgiving and the customs agents in Detroit erased about 4,500 pictures on his laptop. Here's the story in his own words. Somebody please tell me if this is legal, and if not what steps to take.

Coming back from Thailand on NWA, I my point of first destination was
Detroit. I have been stopped when I come back from Thailand or Asia
on every occasion. I always plan time for them to search my bags and
everything I own. I did the same this time. However, this time I
asked for a supervisor and he came over. I asked if I was on a list
and he said, I have no idea. I said why wouldn’t you tell me if I am
on a list. He said, “You know the answer to that question.” I said,
“No, I actually don’t.” He walked away.

After 40 min of checking my luggage and my computers, they took my
computers from the open area behind into a secure invisible room I
was not able to see what the did. I asked that they not remove them
from my site and they kept going. I asked why they were being taken
and they did not respond.

When they returned, they said I could repack my things and go. I
again asked for a supervisor. He came over and I asked him for his
card. He said he did not have one. I asked for him name. He gave
it to me but it was of French origin and could not spell it and asked
that he spell it for me. He refused and left. I asked 3 other
agents for him to spell the name and they all refused.

When I got back home, I found 2 things. One, they had put spy ware on
my computer when I logged in the first time. I will now have to
reformat my entire computer. Second, they deleted my entire photo
library. It was filled with scans I had made of my Aunt’s family
albums. It had over 4500 photos in it. None were porn. None were
questionable. None were inappropriate.

I did have other porn on the computer as I own a porn website that is
legal age porn. With those photo sets in another area of my
computer, they each had a proper ID that would fulfill the new 2257
requirements.

They checked my documents, read my e-mail and made a backup of my
computer hard drive and another drive I use for ITunes.

Is this legal? What recourses do I have?

[sarcasmo]

1. I am sure they know you own a Porn website, that would be my guess why

you get searched all of the time. I had some issues in the Military back in 88 and that is why I get searched every time I fly, and I am only flying with in the States.
I remember a previous thread months ago that mentioned something about suing to find out if your name was on the watch list. It sounds like you might need a lawyer since they put spyware on your computer with out your consent.

[ReverendDeuce]

2. I don't buy this...

40 minutes? To copy everything on the hard drive? I find that dubious at best. Maybe 40 minutes -- but that would leave them NO time to do anything else. Possibly the only way to do this in 40 minutes would be to use an industrial drive duplicator which would replicate the drive at the block level. These can be made to fit inside cases for professionals to use, so it's not outside the realm of possibility. But again, this would leave them little time to go about deleting the family album.

That said, why on earth would they **erase** the photographs? If they wanted to gather evidence, the absolute last thing they would want to do is tip you off somehow.

And what kind of "spyware"? If the feds wanted to install spyware, they certainly would not use anything that your anti-spyware application will discover.

Really, this guy will have to do better than this. It has bogus written all over it.

[MelissaB]

4. You don't have to buy anything, but this is what happened.

You honestly think that customs doesn't have the ability to copy a hard drive in 40 min?

[ReverendDeuce]

8. I honestly don't...

Have you ever dealt with anyone from customs?

Nonetheless, I never said they didn't do it -- I said I find it dubious. I am skeptical that they have a) the hardware on hand, b) the training to use the hardware, and c) the time.

Regardless, let's say they managed to defy physics and do a block-level clone of the guy's drive within 40 minutes. They now have their evidence. **WHY** the hell would they then go back in, delete the guy's family album, fuck with his iTunes bullshit, and install some kind of easily detectable (by commercial software, no less) "spyware"...

That's the whole point of my post.

If TSA/customs/whoever are **THAT** tragically inept, then we're worse off than the right wingers claim we are... yech.

[MelissaB]

16. I'm going to ignore the other BS and say thank you for making an excellent point.

**WHY** the hell would they then go back in, delete the guy's family album, fuck with his iTunes bullshit, and install some kind of easily detectable (by commercial software, no less) "spyware"...

That's the whole point of my post.

If TSA/customs/whoever are **THAT** tragically inept, then we're worse off than the right wingers claim we are... yech.

BTW, they question people about iTunes because if you have illegal music/movies they can get you that way. :)

[ReverendDeuce]

19. That or they just wanted to copy his MP3 collection.... n/t

n/t

[MelissaB]

22. No, if he got his movies/music illegally they could have arrested him.

He had a shit load of tv shows and music on his computer and ipod.

[ReverendDeuce]

26. They'd have to prove they were stolen first...

How many people get arrested for having an MP3 player on their person? Heh.

I think it's more likely they found the collection of "Lost" episodes and wanted their own personal copy.

[MelissaB]

28. Anything that is encrypted can be seized at customs if you refuse to give

them the password for the encrypted area.

[lapfog_1]

12. No, not if it was full.

Tell me the specifics of your drive and how "full" you think it was.

Most laptop drives are not high performance nor do they have the latest in interface technology. Which means that your max disk transfer rate is something like 20 MB/sec (and that's not using windows software), that's about 72 GB/hour. So if you have an 80 GB drive, it would take about an hour to do a track by track copy (which gets you that 20 Mb/sec rate). If you try to copy file by file with an NTFS file system, there will be a lot of disk seeking and so on, and you won't get near the max possible transfer rate... otoh, you only have to copy the actual files that exist, so it now depends on how much data you have.

What leads you to think they copied everything? Were there any changes to files still on your computer?

[Xithras]

9. Umm, Ghost can do it, and any idiot can use it.

If the computer has a floppy drive and a network jack (most do), replicating is a simple matter of booting onto a Ghost floppy and jacking into the network to store a remote Ghost image. We do this all the time at work to take snapshots of certain important servers and desktops, and it takes no time at all. I imaged my desktop at work last week, with about 20Gb of data on it, and the process only took about 25 minutes.

I still don't get the erasing, but imaging the drive is cake.

[ReverendDeuce]

18. I never said it was not easy... I use Ghost weekly...

Ghost does not do a block-level copy, though. It does a file-by-file filesystem copy. If the person had a large drive, 40-80GB, copying the drive would easily take an hour -- especially a slow laptop drive (typically 4200 RPM at the spindle).

Seriously, because I am talking above your head doesn't mean I've neglected to consider the obvious.

The only way they could conceivably do this in the stated time is a block level copy. Even then, nobody has stopped to wonder **why** they wanted to do this.

I think the guy is on crack.

[MelissaB]

20. He has a top of the line Mac...

[ReverendDeuce]

24. It's a Mac? Ghost wont work period on UFS...

The only options would be a sector copy, which it turns out Ghost can apparently do. I've never used this however, as I typically don't have disks of like geometry to screw with.

[acmejack]

3. I would doubt it.

But I would say that a whole lot mote documentation about the computer is required. A lot more technical data is necessary about the the alleged spyware. Even the former presence of the deleted files should still be able to proved by a competent computer forensics type. Google it! I imagine one needs to collect all this information.

[pretzel4gore]

5. contact the congressman for that area

value the pics at $20 per and demand 9 grand from the nazipoohs.....you're a free citizen, pay your taxes and those punks WORK FOR YOU, not bush's asshole....
you can use your mistreatment to cause those worms some sleep.....worry them, like you worry a tooth ache! nazipoohs are all the same: the minute the light shines on them, they fill their drawers!
consider it a hobby...have fun

[MelissaB]

25. He will contact his congressman and senator.

Thanks!

[aquart]

30. Do porn site proprietors have a guild?

Do they have any umbrella or central organization dedicated to protecting their rights? With lawyers? They would have to be notified too.

And the ACLU.

[Xithras]

6. Probably not, but it might be recoverable.

It would be tough for the TSA to argue that their search rights extend to examining the files on your computer, but even if they did the TSA doesn't have the right to delete them. If they're illegal, the TSA should have siezed the laptop as evidence. If they were legal, the TSA would have had no statutory right to delete them in the first place.

Now, there's the catch. Beyond his word, is there any evidence that this occurred? You may believe him, I may believe him, but unless there's sufficient evidence to convince a judge and jury none of it matters.

On the upside, tell your relative to download a free program called Restoration on a DIFFERENT computer. He can copy the program onto a floppy disk, move that floppy to his laptop, and use it to recover most of his deleted files. As long as he hasn't overwritten their space, he should be able to bring most of it back. About a year ago my wife accidentally deleted several hundred pictures from my computer, which is set to empty the recycle bin every time it's rebooted. Restoration brought all but a handful back.

[MelissaB]

7. They've searched his computer the last 3 times he's come home, so this isn't the first time.

This is the first time anything was erased.

The guy is sitting right beside me now, and I'll let him know about the Restoration program. Thanks so much!

[Xithras]

11. Link

http://www.pcworld.com/downloads/collection/collid,1295-order,1-c,downloads/files.html

I prefer Restoration simply because it fits on a floppy. There are many great programs out there to recover destroyed files, but most require installation onto the computer. Anything installed overwrites whatever deleted files were previously there, so installing an undelete utility will actually destroy many of the files you want it to recover. Install Restoration onto a floppy and it will allow you to bring the files back without damaging the files that were lost. Just make sure you download it on a different computer.

[MelissaB]

27. Here's a related article

Laptop seizure raises concerns over firms' data

Travel managers worry about what can happen to proprietary information at customs.

By James Gilden, Special to The Times
November 4, 2006

It may surprise many air travelers, but your laptop and its contents are far from secret at the nation's international airports. Increasingly, this is prompting new privacy concerns for business travelers.

Customs and Border Protection agents have the authority to search and seize laptop computers belonging to travelers entering the United States, those of U.S. citizens and foreigners alike. And they use it.

But just how far these officers can go in inspecting the contents of an overseas traveler's laptop is being tested in federal court.

In July 2005, Michael Timothy Arnold, then 43, of San Juan Capistrano arrived at Los Angeles International Airport after a nearly 20-hour flight from the Philippines, according to court documents.

After retrieving his luggage from baggage claim, he proceeded to the customs checkpoint. An agent selected him for additional screening because she was targeting single males between 20 and 59 who were returning from Asia.


More: http://www.latimes.com/business/la-fi-biztravel4nov04,0,3063025.story?coll=la-home-business

[Kelly Rupert]

10. This doesn't even make sense.

Coming back from Thailand on NWA, I my point of first destination was
Detroit.

(Northwest does not fly direct from Thailand to Detroit, or vice-versa.)

I have been stopped when I come back from Thailand or Asia
on every occasion. I always plan time for them to search my bags and
everything I own. I did the same this time. However, this time I
asked for a supervisor and he came over. I asked if I was on a list
and he said, I have no idea. I said why wouldn’t you tell me if I am
on a list. He said, “You know the answer to that question.” I said,
“No, I actually don’t.” He walked away.

After 40 min of checking my luggage and my computers, they took my
computers from the open area behind into a secure invisible room I
was not able to see what the did. I asked that they not remove them
from my site and they kept going. I asked why they were being taken
and they did not respond.

(This is kind of suspect. I haven't ever seen anything like this; rather, the customs workers I've experienced have made sure to ask my permission every step of the way, and I've had more than a few "SSSS" tickets.)

When they returned, they said I could repack my things and go. I
again asked for a supervisor. He came over and I asked him for his
card. He said he did not have one. I asked for him name. He gave
it to me but it was of French origin and could not spell it and asked
that he spell it for me. He refused and left. I asked 3 other
agents for him to spell the name and they all refused.

(Again, kind of unbelievable. First, French names are not particularly hard to spell. Secondly, this guy didn't even make a stab at it. Thirdly, why on Earth would they tell him his name but not how to spell it?)

When I got back home, I found 2 things. One, they had put spy ware on
my computer when I logged in the first time. I will now have to
reformat my entire computer.

(What? That's almost nonsense. What do you mean by spyware? They installed Comet Cursor? Do you mean top-secret government spyware that has never been heard of by anyone, but which was caught by a routine Ad-Aware check?)

Second, they deleted my entire photo
library. It was filled with scans I had made of my Aunt’s family
albums. It had over 4500 photos in it. None were porn. None were
questionable. None were inappropriate.

(Doesn't make sense. They'd have to go out of their way to do this, and it gains them nothing. If they're just keeping tabs on him because they know he's a pornographer repeatedly flying to the child-pornography capital of the world, they have no incentive to vandalize his family photo albums.)

I did have other porn on the computer as I own a porn website that is
legal age porn. With those photo sets in another area of my
computer, they each had a proper ID that would fulfill the new 2257
requirements.

(So they deleted all of your non-porn image files, and left the porn intact and unmolested. That doesn't even begin to make sense. If you're going to accuse random illegality, please make it reasonable.)

They checked my documents, read my e-mail and made a backup of my
computer hard drive and another drive I use for ITunes.

(How do you know? The computer wasn't in your sight. And again, what on Earth would they gain by messing with your iTunes? And as another poster said, this would take longer than 40 minutes.)

Is this legal? What recourses do I have?

(My guess is that it didn't happen, and so you have no recourses.)

[MelissaB]

13. I'm glad you edited, because that was incorrect.

I didn't say it was a direct flight. The first city in the US was Detroit.

2. Just because it didn't happend to you doesn't mean it didn't happen.

3. Fercristsake on the name...

4. They left the freaking porn and deleted the family pictures. Want to come over and see. :)

5. Read the response to it taking longer than 40 min.

6. I really have time to make this shit up...not!

[The Velveteen Ocelot]

15. You can get to Bangkok from Detroit and back on NWA via Tokyo (NRT).

So maybe this person meant that DTW was the first domestic stop (that is, the first confrontation with TSA or US Customs people). As to the rest of it -- I don't know. I can't imagine why they'd want to delete family photos or install (obvious) spyware.

[MelissaB]

17. He did fly through Tokyo. n/t

[IDemo]

14. Unless the photos were 'wiped', they can be retrieved

and I doubt, even if customs felt somehow justified in deleting files from this computer, that they used a disc cleaning utility as well. Try GetDataBack or a similar tool. Do a Google on 'data recovery'.

[ReverendDeuce]

23. Assuming he has not overwritten the bits on the disk...

If he has, then he'll need to spend a several thousand dollars with some disk forensics experts to recover the data.

Or, he can use the undelete utility you mentioned... if he has not done much with his laptop, he may be able to recover a couple thousand photos successfully.

If he's concerned about his laptop, he should be a) keeping regular backups, b) encrypting anything he doesn't want strangers getting into should his laptop get stolen.

[Imagevision]

21. Is visiting Porn sites illegal??

[MelissaB]

29. Well, I think you're safe for now.

:hide:

[high density]

31. It means he should have a backup plan in place for his computer

Write the family photos to a DVD+R or whatever before you go on a worldwide jaunt with irreplacable data on your laptop. Move the porn there as well. (And yes, I'm sorry, but this story smells like BS to me. What spyware was installed? How did he know that the computer hard drive(s) had been "backed up"? )