Skip to content

Device minimization and border crossings in Asia

Carrying your everyday phone and laptop across a border is fine almost everywhere, almost always. The risk lives in the small set of crossings where it isn't: a destination where customs can inspect your device, where a chat history or a single app is enough to start an investigation, or where your account stays signed in and an officer scrolls through it while you stand at the desk. For journalists, human-rights defenders, NGO staff, researchers, LGBTQ+ travelers, and anyone returning to a less open jurisdiction, the safest device is the one that holds almost nothing when it crosses the line.

This page is built in two halves. The first is general device-minimization OPSEC that applies to any border. The second is Asia-specific border-search context, jurisdiction by jurisdiction, because the rules differ sharply and the wrong assumption is dangerous here.

Why this page exists

EFF's Things to Consider When Crossing the U.S. Border is the gold standard for this topic, and we send you there for the US. The problem: it is structurally US-law-only, and even the Thai, Vietnamese, and Burmese translations still describe US law, which misleads travelers crossing borders in Asia. anoni.net is a volunteer community in the Sinophone Asia-Pacific, so this page keeps the general OPSEC that transfers everywhere and adds the regional border context that the canonical guide does not cover.

General framing, not legal advice

Border-search law changes fast and varies by checkpoint, officer, and your nationality. The per-jurisdiction notes below are a starting point for your own research, not legal advice. Verify the current rules against official sources and, for real exposure, consult a lawyer or an organization on the ground before you travel.

Why minimize before you travel

The principle underneath everything on this page: an officer, a thief, or a malware-laden public network can only reach what is actually on the device. Encryption, strong passcodes, and careful conduct at the desk all matter, but the single most reliable control is having less to find.

A normal phone is a poor travel device for a sensitive trip. It holds years of messages, a logged-in social-media graph, photo metadata pinning where you live and who you see, saved passwords, and cloud sync that quietly pulls everything else back down. None of that needs to cross the border for the trip to work. The sections below are roughly ordered by how much they reduce, from a quick pre-trip cleanup to carrying a separate clean device.

This is one half of threat modeling: before you decide how far to go, name the adversary (customs? a hostile destination? a colleague who borrows your laptop?), what they can reach, and the consequence if they reach it. A short threat model per trip fits on one sheet of paper and reliably catches preparation gaps.

Back up before you go, and watch the cloud double-edge

Reducing what's on your device only works if you can get it back. Make a full backup before you strip anything down, ideally an encrypted local backup to a drive you leave at home rather than a cloud backup you can reach from the road.

Cloud backups are a genuine double-edge for travel:

  • They speed recovery if a device is lost or seized, which is the reason most people leave them on.
  • They also mean that signing into your account from any device, including under pressure at a border, can pull down everything the cloud holds: messages, photos, full chat history. A wiped phone with live cloud sync is not actually minimized.

Practical handling:

  • Take the backup first, verify you can restore from it, then delete the sensitive material off the travel device.
  • Pause cloud backup before you travel, resume after. On iPhone, audit Settings → Apple ID → iCloud for which apps sync; on Android, WhatsApp's Google Drive backup is a common surprise (WhatsApp → Settings → Chats → Chat Backup).
  • Signal's messages don't reach Apple iCloud, but an iOS device backup includes Signal's data folder if device backup is on. Signal also shipped its own end-to-end-encrypted Secure Backups (v8.0, February 2026) stored on Signal's servers; whether to opt in depends on your threat model1.
  • If you're worried about device loss en route, a local encrypted backup before leaving beats relying on a cloud you'd have to sign into from the road.

The clean-device strategy

For the highest-risk trips (a destination that criminalizes your work or identity, sensitive reporting, returning to a jurisdiction with hostile inspection powers), the most reliable approach is to not bring your real device at all.

  • Carry a separate travel device: a cheap secondhand Android, factory-reset, signed into a fresh account that isn't tied to your real email.
  • Install only what the trip needs (maps, translation, hotel booking, the one messenger you'll actually use).
  • Leave your main phone at home and sync back after the trip.

The cost is real (a second device, the setup time), but it's more dependable than wiping and rebuilding your main phone before and after every crossing, where one forgotten app or cached login defeats the whole exercise.

If a clean device isn't practical, the fallback is a thorough pre-trip cleanup of your main device:

  • Uninstall sensitive apps rather than hiding the icon. Dating apps, community apps, anything tied to work that shouldn't travel.
  • Sign out of all accounts, including alt accounts on Instagram, Threads, Bluesky, and the like. Officers commonly look at what's currently signed in, which is far easier than searching a wiped device.
  • Clear browser history, bookmarks, and cookies across every browser on the device.
  • Back up and delete sensitive conversations (Signal, Telegram, LINE, WeChat) to your home backup first, then remove them from the travel device.
  • Audit the camera roll and cloud photo libraries. Sensitive images can be moved to encrypted storage and re-downloaded after the trip.
  • Check the small stuff: email signatures, wallet/loyalty cards, lock-screen wallpaper. Identity leaks through details.

For LGBTQ+ travelers specifically, the border section of our LGBTQ+ guide covers the same cleanup with attention to dating apps, community-app traces, and destinations that criminalize same-sex conduct.

At the border: conduct and device state

How you carry the device through the checkpoint matters as much as what's on it. A few habits, none of which require special tools:

  • Use a strong passcode, not biometrics, at the border. A 6-or-more-digit PIN (better, an alphanumeric passphrase) is what protects the device. Turn off Face ID and fingerprint before you reach the checkpoint. A face or finger can be applied to a phone in seconds, sometimes without your active cooperation; a passcode you have to type is harder to compel and, in some jurisdictions, better protected legally2.
  • Power the device fully off before arrival. A phone that has been unlocked since boot sits in an "after first unlock" state, where much of its data is decrypted in memory and far easier for forensic tools to extract. A full power-off returns it to the "before first unlock" state, where file-based encryption keeps data locked until the passcode is entered, and clears any in-memory unlock state3. Powering off also disables biometrics on both iOS and Android until the next PIN entry.
  • Stay calm and don't volunteer. Don't offer to unlock, don't narrate what's on the device, don't hand over passwords unasked. Comply only with an explicit, lawful request, and know that the consequence of refusing varies enormously by jurisdiction (see below).
  • Know the trade-off of refusing. In some places refusal means denied entry; in others, device seizure; in a growing number, a criminal charge. Decide your line before you're at the desk, not in the moment.
  • Have a fallback contact. If a device is seized or you're detained, you want a way to reach a colleague, a lawyer, or a helpline. The Access Now Digital Security Helpline is 24/7 and multilingual; contact them before travel if you expect real exposure.

SIM, eSIM, and the history that travels with you

The SIM in your phone carries a record, and the question is who holds it and whether the destination's authorities can tie it directly to you. Three options, three different exposures:

  • Local real-name SIM bought on arrival: your passport (and, in a growing number of places, your face) is bound to a local number that sits in the local carrier's and often the government's database. Local law enforcement can query it on the spot, and the record is frequently retained long-term.
  • Home-number roaming: the carrier that holds your identity is back home. The destination sees a foreign roaming connection and its locations, but tying that to you usually requires a cross-border legal request.
  • Data-only eSIM with no local number: there's no local-SIM layer at all; your identity mostly lives with the eSIM provider and your payment record.

For the threat of destination surveillance, roaming and data-only eSIMs keep the identity mapping outside the destination, which makes on-the-spot attribution harder. A long-term personal SIM crossing into a hostile jurisdiction is the opposite: it carries your telco history and prior locations with it. Buy a local real-name SIM only when you genuinely need a local number (for example to receive a verification code), and weigh that against the on-arrival registration it triggers. One caveat to the eSIM advantage: real-name registration is spreading even to data-only eSIMs in some places, so verify the destination's current rule rather than assuming an eSIM is anonymous.

Per-jurisdiction border context (Asia)

The notes below cover border device-search powers specifically, with two reference points (US and UK) that many travelers already half-know but routinely misapply to Asia. This is general framing as of mid-2026, not legal advice. Verify against official sources before you travel; these powers are exactly where wrong specifics are dangerous.

United States and United Kingdom (the rules people already know)

Most travelers' mental model of "what happens at the border" comes from the US and UK. It does not transfer to Asia, so it's worth stating plainly and then setting aside.

  • United States: Customs and Border Protection can search phones and laptops at the border without a warrant and can request that you unlock them. US citizens can refuse and cannot be denied entry for refusing, but the device may be seized and held for days to weeks; non-citizens who refuse may be denied entry4. CBP reported searching over 47,000 devices in 20245. For anything US-specific, use EFF's crossing-the-US-border guide, which is the authority on this and which we don't try to reproduce.
  • United Kingdom: Under Schedule 7 of the Terrorism Act 2000, examining officers at ports and airports can stop and question travelers without suspicion, examine devices, and require passwords; refusal is itself a criminal offence, and people have been prosecuted for it6. This is a sharper power than the US one, and it surprises travelers who assume the UK is "like home."

Hong Kong

The most significant recent change in the region, and the one most likely to catch travelers who assume Hong Kong is low-risk. Two distinct measures took effect within days of each other in March 2026:

  • A National Security Law amendment (Legal Notice 27 of 2026), effective 23 March 2026, makes it a criminal offence for a person under a national-security investigation, or anyone believed to know a seized device's password or decryption method, to refuse to provide it. The maximum penalty for an individual is one year's imprisonment and a HK$100,000 fine; knowingly giving false information carries up to three years and HK$500,0007.
  • Separate border powers, effective 30 March 2026, let officers at immigration checkpoints require travelers to unlock devices regardless of any national-security suspicion. These apply to all nationalities, including transit passengers who clear immigration. Airside-only transit, changing planes without entering, is generally outside the scope.

Together these remove the old assumption that passing through Hong Kong was low-risk. For anyone moving between Hong Kong, Macau, mainland China, and Taiwan, the working assumption at every leg is that your device can be lawfully searched at the checkpoint, so run the pre-departure audit each time.

Mainland China

Treat device inspection as a baseline assumption. Procedures issued by the Ministry of State Security, effective 1 July 2024, give state-security officers broad authority to inspect electronic devices (phones, tablets, laptops) and gather "electronic data" including messages, emails, chats, documents, images, and app records, at borders, in transit, and inside the country. Routine inspections are framed as targeted at counter-espionage subjects rather than every traveler, and require internal approval, but emergency provisions allow warrantless checks, and the practical reality reported by travelers is that spot checks of phones and laptops do happen at some ports8. Combined with mandatory real-name-plus-face SIM registration, the working assumption for sensitive travel is that everything on a connected device is reachable. A clean device is the safest answer here.

Singapore

Day-to-day, mainstream services are reachable and most travelers clear immigration without a device search. The relevant exposure is the breadth of statutory search and arrest powers rather than a routine border-phone-search regime. Amendments to the Criminal Procedure Code in 2024 broadened powers to search items in a person's possession or control in connection with an arrest, and the legal threshold for various interventions is comparatively low, so don't treat "no routine search" as "no possible search." The larger practical risk in Singapore is what you publish, given POFMA (the online-falsehoods law), defamation, and foreign-interference legislation, more than what's on your phone at the desk. We could not verify a specific, current Singapore border device-search-and-compelled-unlock statute of the Hong Kong or UK kind, so we describe the powers generally rather than cite one; confirm with the Immigration & Checkpoints Authority before relying on any specific claim.

Malaysia

Customs and immigration powers center on declarations of goods, cash, and prohibited items rather than a publicized device-search-and-unlock regime. The practical risk for many travelers is content-based: material touching the monarchy, religion, race, or sedition can trigger follow-up, and for LGBTQ+ travelers, federal Section 377 plus state-level Islamic enforcement mean dating-app conversations or location data found on a device can become an investigative lead in enforcement actions9. Bring a minimized device and coarsen or remove location-revealing data. We could not verify a specific Malaysian border statute compelling device unlock, so treat content-based follow-up rather than routine forced unlock as the realistic threat, and verify current rules before travel.

Thailand

Routine immigration and customs checks are not deep device searches. Officers may ask to see proof of tourist intent (an itinerary, a hotel booking, sometimes a glance at messaging contacts), and can deny entry if unconvinced, but accessing the internal data on your phone generally requires a court process under Thailand's Computer Crime Act, and deep extraction happens in the context of a criminal investigation rather than a border line10. The disproportionate risk in Thailand is legal exposure from what you post or carry: lèse-majesté (criminal insult to the monarchy) carries 3 to 15 years per offence and has been applied to foreigners, and even a like or a share can attract liability. Never carry or post anything touching the royal family. The device threat here is downstream of a content offence, not the border check itself.

Macau, and the rest of the region

For Macau and several other Asian jurisdictions, public, verifiable information on border device-search powers specifically is thin. That absence of documented power is not the same as a guarantee, so apply the general OPSEC above: minimized device, strong passcode, biometrics off, powered down at arrival. For a country-by-country briefing tuned to your exact destination, dates, and role, our pre-departure AI briefing page gives you copy-paste prompts to run on your own AI without any query reaching us, and lists the primary sources (OONI, Freedom House, Access Now, your foreign ministry) to verify the answers against.

Where to go from here

  1. Signal — Secure Value Recovery and Secure Backups — Signal's end-to-end-encrypted backup feature, shipped in v8.0 (February 2026). ↩

  2. Fifth Amendment Does Not Protect Against Biometric Phone Unlock, Says 9th Circuit Appeals Court — ID Tech Wire, on the legal asymmetry (in the US) between compelling a passcode versus a fingerprint or face. The legal protection is US-specific; the practical point (biometrics are easier to compel physically) is general. ↩

  3. BFU and AFU Lock States — DigForCE Lab, Dakota State University, on why a powered-off "before first unlock" device resists forensic extraction far better than one that has been unlocked since boot. ↩

  4. Border Search of Electronic Devices at Ports of Entry — U.S. Customs and Border Protection, official statement of CBP's warrantless device-search authority. ↩

  5. What to Know About Airport Phone Searches at the US Border — KQED, citing the CBP figure of over 47,000 device searches in 2024 and the seizure-versus-denial distinction for citizens and non-citizens. ↩

  6. Examined under Schedule 7 of the Terrorism Act 2000: What are my rights? — Liberty, on the obligation to answer questions and supply passwords, and that refusal is a criminal offence. ↩

  7. Security Alert: Refusal to Give the Government Passwords to Personal Mobile Devices Criminalized in Hong Kong — U.S. Consulate General Hong Kong & Macau, 26 March 2026. Penalty and scope figures follow Hong Kong Free Press (23 March 2026) and The Standard. The border-search powers effective 30 March 2026 are a separate instrument. ↩

  8. New rules let China's state security police check people's devices — Radio Free Asia, on the Ministry of State Security procedures effective 1 July 2024 governing inspection of personal electronic devices. ↩

  9. Malaysia: Country chapter — World Report 2024 — Human Rights Watch, on Section 377, state-level Islamic enforcement, and the use of app data in enforcement actions against LGBTQ+ people. ↩

  10. Can immigration check your phone when you arrive in Thailand? — The Thaiger, on the warrant requirement under the Computer Crime Act for accessing internal device data, and the separate, severe lèse-majesté exposure. ↩