Employees who travel internationally have been issued corporate mobile devices. When traveling through border security employees report border police officers have asked them to power on and unlock…

Post-travel forensic inspection is a reactive control that does not prevent data exfiltration that has already occurred during the border crossing event.

Full-device encryption ensures that when police connect the device to a forensic laptop, all stored data remains unreadable without the encryption key even while the device appears powered on; biometric authentication means re-authenticating the device requires the employee's physical presence, limiting the window of exposure to only the period when the employee is actively authenticated and directly supervising the device.

A monitoring application may record the officer's behavior but does not technically prevent data from being copied or read during the laptop connection.

A hardware-backed encrypted container protects only the data explicitly stored within it, leaving all other device data unprotected once the employee unlocks the device under compulsion.

Issuing sanitized devices prevents employees from having any working applications or data available during travel, rendering the devices non-functional for legitimate business purposes.