Why Honeybadger Solutions LLC

Travel, borders and the legal picture

This is where clients most often need advice they had not thought to ask for.

At a United States border, and at many others, devices may be inspected under authority that does not require the same basis as a search elsewhere, and travellers can be asked to unlock them. The practical answer is not defiance; it is not carrying what you do not need. Clean travel devices with only the data required for the trip, sensitive material retrieved after arrival, and a documented organisational policy so the traveller is following a rule rather than making a decision at a counter while tired.

Compelled unlock is an unsettled and evolving area, and the legal treatment of a passcode you know has generally differed from that of a biometric that is part of your body. That distinction has practical consequences for how a device should be configured before sensitive travel or before a device is likely to be seized. We are not attorneys and this is not legal advice — but it is a question worth putting to counsel in advance rather than discovering at the moment of seizure.

Export control also reaches encryption products in ways that surprise people, particularly for organisations issuing hardened devices to staff travelling internationally.

Where devices meet the rest of the practice

Device work sits between several services and is often where a case actually starts. If the concern is that a device is already monitored, that is counter-surveillance — vehicle, phone and account review for trackers, stalkerware and shared logins. If a device holds evidence, nothing should be changed before digital forensics preserves it, because hardening a compromised device destroys the record of the compromise. If the organisation needs the estate monitored rather than the handset hardened, that is managed detection. And for principals and executives, device discipline is part of a wider posture covered under executive protection.

One sequencing rule worth stating plainly: if you suspect a device is compromised, preserve before you clean. A factory reset removes the evidence along with the problem and forecloses any legal route afterwards.

How we work, and what we will not claim

Engagements start with a threat assessment rather than a product recommendation, because the correct answer for a person worried about a former partner is different from the answer for a company worried about a competitor, and different again for someone facing a capable state adversary. The last of those, we will say honestly, is beyond what commercial hardening reliably defeats — and we would rather say so than sell against it.

Assessment covers what needs protecting, from whom, and what happens if it is exposed; the current device, account and communications posture; the gaps that matter; and a prioritised set of changes with the free ones first. Implementation covers configuration, management enrolment, recovery key escrow with tested restore, communications platform selection, travel policy, and user training — because the strongest configuration in the world is undone by one person who was never told why it was there.

Guard services in Arizona are licensed under A.R.S. Title 32, Chapter 26 and investigative work under Chapter 24; Honeybadger holds licences 1759798 and 1759795. We do not sell immunity, and we will tell you where a threat exceeds what a device can do.

Frequently asked questions

Background reading: What an encrypted phone actually protects — and what it does not