A phone is not a phone. It is a filing cabinet that happens to make calls: years of messages, photographs of everyone you know, saved logins, location history, and the recovery route into every other account you own. That is fine on your sofa. It is less comfortable in two ordinary situations — standing in a border queue, and standing in a crowd at a demonstration.
Neither situation is a spy film. At a border, the usual experience is that nothing happens at all; officials in many countries do have broad powers to inspect belongings, including electronic devices, but most travellers are waved through. At a protest, the realistic risk is rarely a targeted search: it is a dropped phone, a cracked screen, a dead battery, a pickpocket, or a photograph you posted in good faith that identified someone who did not want to be identified.
One thing has to be said before anything else, and it applies to every paragraph below. Laws differ enormously by country, and this guide is not legal advice. What officials may ask of you, what happens if you decline, and whether a passcode is treated differently from a fingerprint are questions with different answers in different places — and sometimes different answers for citizens and non-citizens at the same border. If your work is sensitive, ask a lawyer or a press-freedom organisation in the relevant jurisdiction before you travel. What this guide can give you is the practical part: decisions made calmly in advance, so you are not improvising while tired and watched.
Decide what travels with you
The most effective step has nothing to do with settings. It is deciding, before you leave the house, what data needs to be on the device at all.
Data that is not on the phone cannot be read from the phone. For a border crossing, that can mean signing out of accounts you will not need, deleting old chat exports and downloaded documents, and turning off the option that keeps cloud files available offline. For people who travel with genuinely sensitive material — journalists, lawyers, researchers — the honest answer is often a second, mostly empty phone, restored from a backup once you have arrived. For a protest, it can be as simple as not carrying photographs of other people’s private lives in your pocket.
Before you delete anything, make a backup you can actually restore, and check that you can still get into your accounts from another device. Your mailbox is the master key to almost everything else, which is why it is worth reading our guide on securing it first.
Lock screens are most of the work
Modern phones encrypt their storage by default, but that encryption only means something while the device is locked or switched off. So the lock is the product.
Use a passcode of at least six digits, ideally longer, and not a birthday. Set the screen to lock automatically after a short delay. Hide message previews on the lock screen, so a phone lying face-up on a table does not read your conversations out to the room. Both major systems also have a setting that blocks data transfer over the charging port while the device is locked — the name varies by version, but it is worth finding and switching on. Turn off any “trusted place” or “trusted device” feature that unlocks the phone without asking.
Face, finger, or passcode
Biometrics are convenient and, for daily life, genuinely good security. They also behave differently in the moments this guide is about: a phone that has just been restarted normally demands the passcode before a face or a fingerprint will work again.
That single fact is the basis of the most useful habit here. Power the phone off before you join the border queue, and know how to power it off — or trigger the emergency lock gesture that disables biometrics — quickly and without looking, before you walk into a crowd. Whether biometrics and passcodes are treated differently by law is exactly the sort of question that varies by country, so treat the habit as practical hygiene rather than as a legal strategy.
If someone asks for your device
Be calm, be polite, and do not lie to officials; misleading them usually creates a far bigger problem than anything on your phone. Answer questions about yourself. If you are asked to unlock the device, you can ask whether the request is voluntary and what happens if you decline — and understand in advance that the consequences of declining range, depending on the country and your status, from a delay, to being refused entry, to the device being kept.
If a device does leave your hands, write down the time, the place, who took it, and any reference number you are given. Assume that anything that was unlocked was seen. For someone whose device was out of sight for a long period and who has real reason for concern, the cautious path afterwards is to change the important passwords from a different device, check the list of active sessions on your main accounts, and restore the phone from a clean backup rather than simply carrying on.
Protests: the unglamorous checklist
Charge the battery and carry a power bank. Turn off automatic joining of open Wi-Fi networks, and switch off Bluetooth if you are not using it. Turn off location history for the day. Write an emergency contact number somewhere that does not need electricity, such as on your arm. Keep the phone in an inner pocket, not in your hand.
If you take photographs, remember that faces identify people, and that a crowd photograph can be a permanent record of who stood next to whom. Blur faces before posting, avoid posting in real time from a place where people are still standing, and be aware that photographs carry metadata — a screenshot of your own photo is a crude but effective way to strip most of it. Consent is not a legal technicality here; it is basic decency towards strangers who did not choose to be published.
What this doesn’t solve
None of this protects you from targeted malware installed by someone with serious resources; if that is your realistic threat model, you need expert help, not a guide. None of it changes what your mobile operator can see, which is that a device associated with you was in a particular area at a particular time. None of it protects data held in someone else’s cloud, or in the phones of the people you talk to. And none of it substitutes for knowing the rules of the place you are entering — a well-configured phone and a badly chosen answer at a checkpoint are not a good combination.
The aim is not invisibility. It is that nothing on your device comes as a surprise to you, and that whatever happens next, you already decided how you would handle it.
