Guide

Devices across borders

A border is the one place where the normal rules about your own devices do not apply. The protections you rely on at home, that a phone is yours, that its contents are private, that nobody may compel you to unlock it, thin out or disappear at the frontier. The preparation that works is subtraction rather than armour: the less a device holds, the less any of this matters.

Published 30 August 2026. Checked against the cited sources on that date.

This guide is practical and general, and describes the position as at 30 August 2026. It is not legal advice. The law at a border is the law of that border, and it changes. Where a specific position matters to you, check it with local counsel before you travel, not at the desk.

What a border can ask of you

In the United Kingdom, an examining officer may stop and question a person at a port under Schedule 7 to the Terrorism Act 2000, and no prior suspicion is required. Paragraph 5 obliges the person questioned to give any information requested and to produce documents of a kind the officer specifies. Paragraph 18 makes it an offence to wilfully fail to comply, or to obstruct an examination, and the Home Office code of practice sets out how the powers are exercised. At a UK port, declining to co-operate is not a neutral act.

In the United States, Customs and Border Protection publishes its position on border searches of electronic devices. It distinguishes a basic search, an officer reviewing a device by hand, from an advanced search, in which equipment is connected to copy or analyse the contents. The latter requires reasonable suspicion or a national security concern. A device that cannot be inspected because of a passcode or encryption may be excluded or detained. Officers disable network connectivity first, so material stored only in the cloud is not reached through the device.

The proportion of travellers whose devices are searched is very small, and CBP publishes the figures each year. But low probability is not low consequence, and the price of refusal differs by jurisdiction: a criminal offence in one place, a detained device or a refused entry in another, an unappealable decision in a third. Which gives the only rule that travels well. Carry nothing across a border that you cannot afford to open.

Travelling with less to find starts at home: reducing the family's digital footprint is the companion piece.

The UAE, specifically

This is the trip that most often goes wrong, and the failure is usually self-inflicted.

Virtual private networks are widely and lawfully used in the UAE for ordinary business purposes. What the federal law on combatting rumours and cybercrimes addresses is misuse; Article 10 of Federal Decree-Law No. 34 of 2021 makes it an offence to use a false address or account to commit an offence or conceal one. Where legitimate use ends is a matter of local law, so confirm the position with counsel in the Emirates. The material risk for most principals is not prosecution. It is a device configured so that ordinary traffic looks like concealment.

Internet calling is the more common surprise. The Telecommunications and Digital Government Regulatory Authority treats calls carried over the internet as a licensed telecommunications service, and applications that are neither licensed nor approved fall within prohibited content. So messaging on a familiar app may work while a call on the same app does not connect, and the workaround a visitor reaches for by reflex is exactly the conduct the law is concerned with. The FCDO travel advice for the UAE adds a detail that catches out security-minded travellers: a licence may be required for satellite phones, listening or recording devices, radio transmitters, powerful cameras and binoculars.

So what does this mean for a principal who lives on a messaging app and a work phone? Travel on ordinary equipment: a stock phone, stock applications, a local number or eSIM, and calls over the mobile network rather than routed around it. Agree before you fly how people will reach you, so nobody improvises at eleven at night. A conspicuously hardened device invites a conversation its owner has no need to have, and is rarely placed to explain.

The travel device, done properly

The work is done before departure, and it is mostly removal.

  • A clean device carrying only what the trip needs. Not a wiped copy of the daily phone, but a device provisioned for this trip: the documents, applications and contacts required, and nothing accumulated over four years.
  • Separate travel accounts where the exposure justifies it. A mail account holding one itinerary is a different proposition from one holding a decade of transactions.
  • Multi-factor authentication that does not depend on a roaming SIM. Codes texted to a number that may not work abroad, and is itself a target for a SIM swap, are the weakest link on the trip. Use a hardware security key, and carry a second one stored apart from the device.
  • A deliberate decision about the primary number. Whether the main SIM travels, stays behind in a device somebody trusted can reach, or is paused, matters more than which handset goes. Know who can authorise a change on that account while you are away, and make sure the carrier does too.
  • Backups completed and verified before departure. If everything on the device exists elsewhere, and has been restored from at least once, a device lost, stolen or detained is an inconvenience and an expense. If not, the same event is an incident.

None of this requires exotic equipment. It requires an afternoon and a list.

Hotel and host networks

Treat every network you did not build as observed. Not because hotel Wi-Fi is uniquely hostile, but because you cannot establish that it is not, and the assumption costs you nothing.

The controls that matter here are dull. Update the operating system and applications before you leave, rather than over a captive portal. Decline anything that asks you to install a profile, a certificate or a helper application to get online, and treat the prompt itself as a reason to use mobile data instead. For anything sensitive, tether to your own connection rather than conference or lobby Wi-Fi. Charge from your own adapter and cable rather than a shared charging point, as the NCSC's guidance for high-risk individuals sets out. And note who can see the screen, which in a business-class cabin is more people than you think.

If a device is taken or inspected

Start from the assumption that the contents and the live sessions on that device are no longer private. That is not a claim about the motives of any authority, it is simply the only assumption that produces a sensible sequence of actions.

Write down what happened while it is fresh: date, place, duration, who conducted it, what was said, what was taken or retained, and any reference number. That record matters later to your lawyers and your insurers. On return, rotate in this order:

  1. The primary mail account, the recovery route to everything else, revoking its active sessions.
  2. The password manager credential and the device passcodes.
  3. Multi-factor enrolments, removing any registered on that device and confirming the rest.
  4. Banking, payment and custody platforms, with any standing authority to instruct.
  5. Messaging applications, re-registering rather than resuming, so linked sessions are cleared.
  6. Anything else holding a persistent token: cloud storage, corporate systems, board portals.

It becomes an incident when there is evidence of use rather than inspection, when the device was out of sight for an unexplained period, when access to an account is refused on return, or when money or instructions move afterwards in a way nobody can account for. At that point stop rotating credentials alone and get help: the order of operations changes when evidence needs preserving. What to do in the first hours of an incident sets out that route.

Sources

Rules described as at 30 August 2026. Border practice and local law change, so check the pages above rather than this one.

Where this sits

Travel preparation is a standing part of the private digital office retainer, because it works as a routine before each trip rather than a project undertaken once: the device provisioned, the account positions checked, the backups verified, the arrangements for reaching you agreed in advance.

The related failure, and the more expensive one, is money moving on an instruction that came from a compromised mailbox or a convincing voice. That is covered in how families and family offices are defrauded.