OVERVIEW

Lake Forest College supports international academic collaboration, research, and travel. When traveling abroad, however, electronic devices and data are at increased risk due to differing privacy laws, network security practices, surveillance standards, and border inspection authorities. This guidance outlines recommended and required steps to protect College data, systems, and personnel when traveling internationally with technology.

1. PURPOSE

The purpose of this guidance is to help travelers understand and reduce the cybersecurity and privacy risks associated with international travel. Following these guidelines helps protect College resources, research data, personal information, and individual travelers from theft, compromise, surveillance, and data loss. The guidance also supports the College’s compliance with regulatory and contractual data protection requirements.

2. SCOPE

This guidance applies to all faculty, staff, students, contractors, researchers, and others traveling internationally on behalf of the College and using College-owned devices or accessing College systems and data. It also applies to personal devices used to access College resources from outside the United States.

3. INTERNATIONAL TRAVEL AND COLLEGE-OWNED DEVICES

College-owned devices should only be taken abroad when the employee is traveling on behalf of the college or performing work approved by their supervisor while traveling, and not accompany employees during their personal, recreational travel.

4. KEY RISKS DURING INTERNATIONAL TRAVEL

Traveling internationally introduces cybersecurity and privacy risks that may not be present while working from campus or within the United States. Network environments, legal expectations of privacy, and monitoring practices differ greatly across countries, which can expose both personal and College data to interception, copying, or compromise. Understanding these risks before traveling is essential to taking appropriate precautions.

4.1 Device Compromise: Public Wi-Fi networks, cellular networks, or state monitoring systems may intercept communications or install malware such as info stealers, remote access trojans, or command-and-control software.

4.2 Data Inspection and Disclosure: Many countries permit border agencies to confiscate, inspect, and duplicate data stored on travelers’ devices for later review. Some nation-states may attempt to defeat device security mechanisms and install keyloggers, surveillance spyware, or rootkits (which modify the firmware of the device to permanently compromise it.)

4.3 Account Credential or “Token” Theft: Logins from state-controlled or compromised Wi-Fi networks in “high cyber risk” locations may be intercepted and decrypted – despite conscientious VPN use – providing attackers with unauthorized access to College data on systems the employee may access through Single Sign-On (SSO.)

4.4 Loss or Physical Theft: Travel increases the likelihood of device loss, theft, or tampering while unattended.

5. PREPARING FOR TRAVEL

Before traveling internationally, it is important to ensure that all devices and accounts are configured to minimize risk and protect College data. Preparing ahead of time reduces the likelihood of disruption, data loss, or account compromise while abroad. Travelers should review the guidance below and take appropriate steps based on their destination, the nature of the information they will access, and the level of personal and institutional risk anticipated during the trip. ITS is available to assist with device preparation, travel loaner devices, and secure access configurations, given sufficient lead time.

5.1 For Travel to Higher Cyber-Risk Regions: ITS strongly recommends the following:

• Travel without technology if possible.
• If devices are necessary:
  • Request a loaner laptop from ITS. A properly-configured College-owned travel device will contain minimal data and can be securely wiped upon return.
  • Copy only the data you will need access to during your travel to the loaner device.
  • Consider purchasing a temporary “travel” phone if your destination poses elevated surveillance or privacy concerns and add it as a registered MFA device before you leave.
  • If its use will be allowed in your destination, work with ITS to ensure your VPN access is configured properly prior to your departure. Access to some College resources may depend upon it.

5.2 For All International Travel: ITS recommends taking the following steps:

• Ensure all storage devices which will accompany you during your travels are encrypted (unless the destination country bans such encryption, such as China.)
• Ensure all available OS and application software updates are installed and local file-sharing services are disabled.
• Remove unnecessary data from the local device. Store this data in your College-provided Microsoft OneDrive instead and ensure local file synchronization is disabled.
• Sign out of applications and cloud services you will not need during your travels.

8. UPON RETURN

Upon returning to campus or the United States, devices used during travel may require additional review to ensure they have not been compromised. Even brief loss of physical possession or connection to unknown networks may introduce risks that are not immediately visible. The steps below outline how to safely reintroduce devices to campus networks and verify account integrity.

8.1 Loaner Devices: Disable Wi-Fi and other radios and power down the loaner device before returning to campus. Return the loaner device to ITS as soon as possible for secure wiping and re-provisioning. ITS can assist with the secure recovery of locally stored files on the device prior to this process if needed.

8.2 Assigned Devices: If you traveled to a lower-risk destination with your College-assigned laptop, please make arrangements with ITS to have the device scanned for malware immediately upon your return to campus. This ensures the device is ready to be used on campus and is suitable for handling College data again.

8.3 Account Security: Upon return from travel, be prepared to change your account password and log into your devices again. This prevents unauthorized access to (or the loss or exposure of) College data due to stolen session credentials.

8.4 Travel Phones: Immediately disable and discard any pre-paid travel phones you purchased for travel to high-cyber-risk countries upon your return. Do not save or reuse these devices.

9. SUPPORT

ITS is available to assist travelers before, during, and after international travel on behalf of the College. Travelers are encouraged to contact ITS early in the planning process to allow sufficient time to prepare devices, pick up loaner equipment, and receive tailored advice based on travel destination and purpose. Contact the ITS Service desk through the usual support channels. For specific advice regarding securing devices, encryption controls, or the cyber risk levels associated with your travel destination, contact the Information Security Manager at infosec@lakeforest.edu.

RELATED POLICIES:

• Acceptable Use of E-Resources Policy
• Data Privacy Policy
• GLBA Compliance Policy
• Information Security Policy

Document Control: