International travel and data security
Information security
It is very common these days for UVic faculty and staff to travel abroad with electronic devices such as laptops, tablets, cell phones, USB drives, and other digital storage devices. If you are traveling with an electronic device, you may have to deal with border officials at some point.
Privacy and security at border crossings
Some foreign governments retain the right to seize travelers’ electronic devices and review their contents. At border controls, officers have widespread powers to stop and search people, and examine their baggage and other possessions including devices such as laptops and smartphones. Failure to unlock an electronic device may cause you to be detained or refused entry to the country.
International travel best practices
- Leave any unnecessary electronic devices at home
- Encrypt your device
- Passphrase-protect your device
- Use different passphrases for different accounts; if you are forced to disclose a password it does not provide access to all of your services
- Do not travel with any unnecessary data that may be subject to search. Use VPN to access Connect or Department File Storage remotely
- If you are asked to unlock or provide a passphrase when crossing a border, UVic has no objection if you comply with the request. Take note if the device is removed from your sight. After the device is returned, always:
- change your passphrase immediately and
- inform your supervisor as soon as possible.
For helpful tips and videos on international travel with electronic devices, see the Electronic Devices Privacy Handbook: A Guide to Your Rights at the Border on the British Columbia Civil Liberties Association (BCCLA) website.
Frequently asked questions
Will online services work in every country or region?
No, there are specific countries or regions where online services such as Duo Mobile for UVic MFA, Zoom, UVic VPN, or Microsoft 365 are blocked due to economic and trade sanctions enforced by the U.S. Office of Foreign Assets Control. This list of countries or regions currently includes:
- Cuba
- North Korea
- Iran
- Sudan
- Syria
- Crimea region
- Sevastopol region
- Donetsk region
- Luhansk region
If you are traveling to one of the above countries or regions, please contact the Computer Help Desk for assistance prior to departure to discuss if there are any available options to access UVic information systems from your destination.
I am travelling with an electronic device I use for work. What do I need to know?
Recently, the US and UK have increased security measures on electronic devices for incoming flights. Travelers on flights coming from several countries will face restrictions on large electronic devices, including, but not restricted to, over-sized smartphones, tablets, e-readers, game consoles and laptops.
Before your trip:
- Ensure your devices are clean and empty.
- If the devices you want to take does contain large amounts of UVic confidential/sensitive information, consider leaving them behind.
- Securely store the files you won't need while you're away in a secure location (i.e., Connect or departmental file storage) and remove them from your device.
- Check the most recent guidelines for the country you are visiting - not all countries allow encryption and some have restrictions on portable electronic devices in your carry-on baggage.
Do I have to show my mobile device to a security officer if there is private information on it?
In many countries, customs or other law enforcement officials are authorized to require travellers to unlock a device using a password or biometric identifier (Touch ID or Face ID), and they may ask to examine what is stored within a device, such as photos, files, downloaded e-mails and other media.
If the device contains work-related personal information, UVic employees should first notify the official that the device contains confidential university information.
If the official is persistent, employees may comply with the demand. However, they should make a reasonable effort to keep the device in sight at all times. After the device is returned, change the password immediately and report the incident to the Chief Privacy Officer (cpo@uvic.ca) as soon as possible.
Failure to unlock an electronic device may cause you to be detained for further inspection or refused entry to the country.
How can I avoid issues when travelling with my mobile device?
Will the electronic ban in the US and the UK affect me?
Certain commercial flights arriving in the United States and the United Kingdom are now subject to restrictions for carry-on electronic devices.
If you are travelling from any of the affected countries below, it is very likely that you will be impacted by the electronic device ban. To ensure that you are following the most up-to-date guidelines, please refer to the Commercial flights to the US Fact Sheet and the Commercial flights to the UK Overview.
Impacted International Flights bound for the US or UK originate from airports in the following countries:
| Country | Travel to US affected? | Travel to UK affected? |
|---|---|---|
| Egypt | YES | YES |
| Kuwait | YES | NO |
| Lebanon | YES | YES |
| Morocco | YES | NO |
| Qatar | YES | NO |
| Saudi Arabia | YES | YES |
| Tunisia | NO | YES |
| Turkey | YES | YES |
| United Arab Emirates | YES | NO |
If you have to travel with your electronic device in a checked bag, put it in a hard-shell case and bury it in the middle of your suitcase. If the device stores personal information, make sure it is encrypted. It is recommended to get a TSA-Approved lock to protect from theft. If possible, take an alternative inexpensive laptop or tablet instead and keep sensitive documents on an encrypted USB and not on the device.
If you choose to only travel with a standard sized smartphone in order to ensure that you can take it in the cabin with you, please be aware that it must be encrypted if it stores any information – including emails – which contain personal information. You are still also at risk for search by border officials and you should be prepared to deal with this if necessary.
If you are travelling with an encrypted device, special considerations may apply. View the Canadian export and foreign import controls on encryption products on the Security Considerations for International Travel with Mobile Devices [PDF] document.
What are the Canadian export controls on encryption products?
What are the foreign import controls on encryption products?
Some countries ban or severely regulate the import and use of encryption products.
Under a set of rules known as the "Wassenaar Arrangement”, travelers may freely enter a participating country with an encrypted device under a "personal use exemption" as long as the traveler does not create, enhance, share, sell or otherwise distribute the encryption technology while visiting.
The countries that support the personal use exemption include: Argentina, Australia, Austria, Belgium, Bulgaria, Canada, Croatia, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Japan, Latvia, Lithuania, Luxembourg, Malta, Netherlands, New Zealand, Norway, Poland, Portugal, Republic of Korea, Romania, Slovakia, Slovenia, South Africa, Spain, Sweden, Switzerland, Turkey, United Kingdom and the United States.
The following nations do not recognize a "personal use exemption". Before traveling to these countries with an encrypted device, travelers will need to apply to the specified governmental agency for an import license:
- Belarus - a license issued by the Belarus Ministry of Foreign Affairs or the State Center for Information Security of the Security Council is required.
- Burma (Myanmar) - a license is required, but licensing regime documentation is unavailable.
- China - a permit issued by the Beijing Office of State Encryption Administrative Bureau is required. The laws in China vary from province to province where the customs officers or border guards make their own interpretation of what encryption means.
- Hungary - an International Import Certificate is required.
- Iran - a license issued by Iran's Supreme Council for Cultural Revolution is required.
- Israel - a license from the Director-General of the Ministry of Defense is required.
- Kazakhstan - a license issued by Kazakhstan's Licensing Commission of the Committee of National Security is required.
- Moldova - a license issued by Moldova's Ministry of National Security is required.
- Morocco - a license is required.
- Russia - licenses issued by both the Federal Security Service (Federal'naya Sluzhba Bezopasnosti - "FSB") and the Ministry of Economic Development and Trade are required. License applications should be submitted by an entity officially registered in Russia. This would normally be the company that is seeking to bring an encryption product into Russia.
- Saudi Arabia - it has been reported that the use of encryption is generally banned, but research has provided inconsistent information.
- Tunisia - a license issued by Tunisia's National Agency for Electronic Certification (ANCE) is required.
- Ukraine - a license issued by the Department of Special Telecommunication Systems and Protection of Information of the Security Service of Ukraine (SBU) is required.
In addition to import controls, some countries have regulations restricting the use of encryption. The most prominent are France, South Africa, China and Russia.
Since laws can change at any time, it's best to check before traveling to ensure that you have the most up-to-date information.