Field guide / Business travel
Have You Considered Your Device Security When Travelling To High Risk Countries?
Prepare before departure. Protect devices while away. Review them on return.
Before travel / During travel / At the border / On return
The context
Digital surveillance capabilities have advanced dramatically since 2023. The proliferation of commercial spyware, increasingly aggressive border device searches, and evolving nation-state cyber capabilities mean that business travellers—particularly those with access to sensitive information, intellectual property, or strategic business intelligence—face unprecedented risks when crossing international borders.
This isn’t just about journalists and activists anymore. Business executives, researchers, lawyers, consultants, and anyone with access to valuable corporate information are now legitimate targets for state-sponsored surveillance and border device inspection.
This guide provides current intelligence on the threat landscape and practical countermeasures to protect your devices, data, and privacy when travelling internationally.
Key Development: In April 2025, reports emerged that the European Commission now issues burner phones and clean laptops to staff travelling to the United States—placing America in the same category as China for espionage risk. This reflects a fundamental shift in how organisations assess digital security risks across all jurisdictions.
Protective Measures: Before, During & After Travel
BEFORE TRAVEL
Priority / Action / Implementation
CRITICAL
Use travel-only devices
Request a loaner laptop and phone from IT. These should be freshly imaged with minimal applications and no access to corporate archives or sensitive data.
CRITICAL
Minimise data on devices
Remove sensitive files, emails, and photos. Log out of cloud services. Delete chat history. Consider a temporary email account.
CRITICAL
Update all software
Ensure operating systems, apps, and firmware are fully patched. Enable automatic updates. An up-to-date OS is your first defence.
HIGH
Enable full disk encryption
BitLocker (Windows), FileVault (Mac), device encryption (iOS/Android). Use strong, unique passwords.
HIGH
Configure remote wipe
Enable Find My Device (Apple), Find My Phone (Android), or corporate MDM capabilities for remote wipe if devices are seized.
HIGH
Back up everything
Create complete backups before travel. If devices are seized, wiped, or compromised, you can restore on return.
MEDIUM
Install mobile threat defence
Consider enterprise MTD solutions (Lookout, Zimperium) or tools like iVerify for behavioural analytics and exploit warnings.
MEDIUM
Pack security accessories
Bring your own charger (not just USB cables), portable battery pack, USB data blocker, webcam covers, and privacy screen filters.
DURING TRAVEL
Priority / Action / Implementation
CRITICAL
Never leave devices unattended
Keep devices on your person at all times. Do not leave in hotel rooms, safes, or checked luggage. Use cable locks or carry secure bags.
CRITICAL
Avoid public USB charging
Use AC wall outlets with your own charger, or portable battery packs. If you must use USB, employ a data blocker device.
CRITICAL
Avoid public/hotel Wi-Fi
Use mobile data or a reputable VPN service. Never access sensitive accounts over untrusted networks. Hotel business centres are equally risky.
HIGH
Disable Bluetooth/AirDrop
Turn off wireless services when not in active use. These can be vectors for proximity-based attacks.
HIGH
Power off at borders
Shut down devices completely before border crossings. This ensures encryption is fully engaged (cold boot protection).
HIGH
Use end-to-end encrypted comms
Signal for messaging, ProtonMail for email. Be aware that metadata (who you contact, when) may still be visible.
MEDIUM
Reject unknown devices
Do not accept loaner cables, headsets, USB drives, or any device offered by hotels, airlines, or strangers.
MEDIUM
Use cash where possible
Minimise financial transaction trail. Prepaid cards or cash reduce tracking of movements and activities.
AT BORDER CROSSINGS
Consideration / Guidance
Know your rights
Rights vary by citizenship: US citizens cannot be denied entry but devices may be searched; visa holders face the most scrutiny and can have visas revoked
Basic vs advanced search
Basic: Manual scroll through content. Advanced: Forensic imaging requiring “reasonable suspicion.” You can request to know which type is being conducted.
Passwords
You may decline to provide passwords (especially citizens), but this can result in device seizure, extended detention, or (for non-citizens) entry denial
Document everything
Note officer names, badge numbers, time of search, what was accessed. Request a property receipt if devices are seized.
Clean devices aren’t suspicious
Having a device with minimal content is legitimate for business travel. You can explain proprietary/client data restrictions require you to travel clean.
AFTER TRAVEL
Priority / Action / Implementation
CRITICAL
Return loaner devices to IT
Do not connect travel devices to corporate network. Return immediately for forensic analysis before reuse or disposal.
CRITICAL
Change passwords
Reset passwords for any accounts accessed during travel. Assume credentials may have been observed or captured.
HIGH
Review account activity
Check login history for email, cloud services, and financial accounts for any suspicious access during or after travel.
HIGH
Report any incidents
If your device was searched, seized, or you noticed anything suspicious, report to your security team immediately.
Who Is at Risk?
The concept of “persons of interest” has expanded significantly. While journalists, activists, and political figures remain high-priority targets, the commercial surveillance industry now enables targeting of a much broader range of individuals:
Traditional High-Risk Categories
Journalists & Media
Investigative reporters, editors, foreign correspondents, documentary makers
Civil Society
Human rights activists, NGO workers, environmental campaigners, legal advocates
Government & Diplomacy
Politicians, diplomats, policy advisors, government contractors
Whistleblowers
Current or former employees with knowledge of sensitive matters
Expanding Risk Categories (2024-2025)
Business Executives
C-suite leaders, board members, M&A specialists with access to strategic information
STEM Researchers
Scientists, engineers, academics in strategic fields (AI, semiconductors, biotech, defence)
Legal Professionals
Lawyers handling sensitive cases, intellectual property, international disputes
Financial Services
Investment professionals, analysts, those with market-moving information
Tech Industry
Engineers, product managers, those with access to proprietary technology
Critical Infrastructure
Energy, telecommunications, utilities personnel with operational knowledge
FBI Assessment: The FBI has stated that US travellers are priority targets for cyber-attack and monitoring/surveillance, particularly those engaged in classified or proprietary research in STEM fields. This assessment applies equally to UK and European business travellers.
The Evolving Threat Landscape
Understanding current surveillance capabilities is essential for effective protection. The threat landscape has evolved significantly across several dimensions:
Commercial Spyware: Beyond Pegasus
The commercial spyware market has proliferated far beyond NSO Group’s Pegasus. Google’s Threat Analysis Group now tracks more than 40 commercial surveillance vendors. Key developments include:
| Spyware | Developer | Capability |
|---|---|---|
| Pegasus | NSO Group (Israel) | Zero-click infection; full device access; sold to 14+ EU member states and numerous governments worldwide |
| Predator | Intellexa/Cytrox | One-click exploit; customers identified in 10+ countries including EU member states; implicated in Greece surveillance scandal |
| Graphite | Paragon Solutions (Israel) | Specialises in live access to messaging apps including disappearing content; used by US DEA; confirmed targeting of European journalists in 2025 |
| Hermit | RCS Labs (Italy) | Works with local ISPs to deploy malicious apps; targets Android and iOS |
Key insight: In May 2025, Meta won a landmark $167 million lawsuit against NSO Group for Pegasus attacks via WhatsApp—but the spyware industry continues to expand. Pegasus has been sold to governments of Jordan, Togo, Poland, Serbia, and many others, often used against civil society.
Zero-Click Attacks: No User Action Required
Modern spyware no longer requires victims to click malicious links. Zero-click exploits infect devices through:
Messaging apps
iMessage, WhatsApp—simply receiving a message can trigger infection
Network protocols
AirDrop, Bluetooth, Wi-Fi vulnerabilities
Missed calls
VoIP call notifications that don’t require answering
Calendar invites
iCloud calendar exploit vectors
2025 Development: Austrian researchers demonstrated “ChoiceJacking”—a technique where malicious USB chargers autonomously bypass user permission prompts, confirming data transfers without user consent.
Vulnerability Alert: In 2025 alone, Apple has disclosed seven Known Exploited Vulnerabilities (KEVs) for iOS—already higher than the total for 2024. Many were identified by Google’s Threat Analysis Group and Citizen Lab through spyware investigations.
High-Risk Countries: Updated Assessment
Risk assessments must now consider multiple dimensions: state surveillance capability, legal protections for privacy, and border search practices.
Countries with Known Commercial Spyware Deployments
Region / Countries with Documented Spyware Use
Middle East & Gulf
Saudi Arabia, UAE, Bahrain, Jordan, Oman
Africa
Morocco, Egypt, Rwanda, Togo, Angola, Botswana
Asia
India, Thailand, Kazakhstan, Indonesia, Singapore, Philippines, Mongolia
Europe
Poland, Hungary, Greece, Spain, Serbia, Azerbaijan
Americas
Mexico, Trinidad & Tobago
Source: Citizen Lab, Amnesty International Security Lab, Recorded Future research (2024-2025)
UK NCSC High-Risk Country Designation
The UK National Cyber Security Centre (NCSC) designates the following countries as high-risk for digital security:
| 🇨🇳 China | 🇷🇺 Russia | 🇮🇷 Iran | 🇰🇵 North Korea |
Travel to these countries requires enhanced precautions including use of loaner devices.
Emerging Risk: United States Border Searches
US Customs and Border Protection (CBP) border searches of electronic devices have reached record levels and increasingly affect business travellers:
| Metric | Data |
|---|---|
| FY 2024 device searches | 47,047 electronic devices searched (42,725 basic + 4,322 advanced searches) |
| FY 2025 device searches | 55,318 searches (record high); Q2 2025 alone set new quarterly record of 14,899 |
| Percentage of travellers | Less than 0.01% of 419 million arrivals—but impacts thousands of professionals |
| Non-US citizen searches | 36,506 (78% of searches); visa holders face highest scrutiny |
Source: US Customs and Border Protection, 2025
Recent Incidents: In 2025, several high-profile cases highlighted the risk: a Lebanese physician was deported after CBP found Hezbollah-related content on her phone; an Indian PhD student had her visa revoked following social media scrutiny; a French scientist was denied entry after DHS alleged he was carrying confidential laboratory information.
Surveillance Methods: How They Target You
Understanding attack vectors helps inform defensive measures:
| Method | How It Works | Risk Level |
|---|---|---|
| Zero-click spyware | Device infected via messaging apps or network protocols without user interaction; provides complete access to data, microphone, camera, location | EXTREME |
| Border device search | Legal authority to inspect device contents at border crossings; can lead to data extraction, device seizure, or entry denial | HIGH |
| Hotel room access | Physical access to devices left in rooms; “evil maid” attacks can install malware or clone storage | HIGH |
| Network interception | Traffic analysis on hotel/airport Wi-Fi; man-in-the-middle attacks; rogue hotspots | HIGH |
| IMSI catchers | Fake cell towers intercept mobile communications and track location | MEDIUM |
| USB charging attacks | “Juice jacking” via compromised public charging stations; TSA issued warnings in March 2025 | MEDIUM |
| Biometric capture | Facial recognition, fingerprint scanning at borders and public places | MEDIUM |
| Social engineering | Targeted phishing, pretexting, relationship building to gain access or information | MEDIUM |
Corporate Travel Security Programme
Organisations should implement a formal travel security programme that includes:
Component / Description
Risk-tiered country list
Classify destinations by risk level; define different device/data requirements for each tier
Loaner device programme
Maintain pool of freshly-imaged travel laptops and phones; 10+ working days notice for preparation
Pre-travel security briefing
Mandatory training on threats and countermeasures before high-risk travel
Post-travel device handling
Defined process for return, forensic analysis, sanitisation, and reuse/disposal of travel devices
Incident response procedures
Clear protocols if devices are searched, seized, or suspected compromised
Executive protection measures
Enhanced protocols for C-suite and board members travelling to high-risk destinations
Industry Standard: Following the European Commission’s lead, many Fortune 500 companies now require burner devices for travel to China, Russia, and—increasingly—the United States. This reflects a pragmatic assessment that even allied nations conduct economic espionage.
Recommended Security Tools
Category / Tools
Encrypted messaging
Signal (recommended), Session (no phone number required), Briar (works without internet)
Encrypted email
ProtonMail, Tutanota
VPN services
Corporate VPN preferred; consumer options include Mullvad, ProtonVPN (avoid free VPNs)
Mobile threat defence
Enterprise: Lookout, Zimperium. Individual: iVerify (behavioural analytics)
Spyware detection
Mobile Verification Toolkit (MVT) by Amnesty International—requires technical expertise
Physical security
USB data blockers, Faraday bags, webcam covers, privacy screen filters, cable locks
Password management
1Password, Bitwarden—generate unique passwords; enable strong 2FA (hardware keys preferred)
Key Resources
Resource / Description
NCSC Device Security Guidance
NCSC High-Risk Individuals Guidance
US NCSC Travel Security Guidance
EFF Digital Privacy at Borders
Citizen Lab Spyware Research
Amnesty Security Lab
Global Guardian Risk Map
CBP Border Search Policy
Conclusion: Security as a Mindset
Digital surveillance and border security regimes have evolved far beyond what most business travellers appreciate. The proliferation of commercial spyware, record-breaking border device searches, and the expansion of state surveillance capabilities mean that device security is no longer optional for international business travel.
The measures outlined in this guide are not paranoid—they reflect the current reality faced by organisations operating globally. The European Commission doesn’t issue burner phones for travel to the United States out of excessive caution; it does so because the risk assessment demands it.
Key principles to remember:
- Assume compromise: Travel with the assumption that your devices may be accessed. Minimise what you carry accordingly.
- Data minimisation: The best protection for sensitive data is not having it on your device in the first place.
- Device discipline: Treat travel devices as potentially compromised from departure. Never connect them to trusted networks without forensic review.
- Stay current: Threats evolve rapidly. Review your travel security posture regularly and stay informed of emerging risks.
- Organisational responsibility: Security-conscious organisations must provide loaner devices, training, and clear policies—not leave employees to navigate these risks alone.
The organisations and individuals who take travel security seriously today will be far better protected against the increasingly sophisticated surveillance landscape of tomorrow.