Travel Security Guidance

Threats

There are a range of ways in which security can be compromised in the course of foreign business travel. Awareness of these risks will help you introduce effective travel security policies to protect your staff and your business. Someone who wants to get access to emerging technologies will be looking to:

• Identify targets
• Access sensitive documents and information, electronically or physically
• Recruit insiders in target organisations

Think about how the following situations could highlight your company  as a prospective target, put your IT and information at risk, or be the start of a recruitment or compromise attempt.

Before you go

Understand the risks

Ensure you understand the environment you are travelling to and any legal risks by considering the following:

• FCDO advice on travel to a country/countries.
• Countries subject to UK sanctions.
• The legal and legislative environment in the country you are travelling to.

Also think about the reason for your travel. Are you confident about the legitimacy and credibility of the people you will be meeting?

• Conduct background checks on your hosts to assess the risks of the visit.

These considerations will help you make an informed decision about the benefits and risks of travelling overseas to achieve your business objectives.

Know your 'red lines'

Before travel, take time to consider the information you are comfortable with sharing to achieve the objectives of the trip. 

• Think carefully about what information you share or present.
• Be clear on the aspects of your business and innovation that you can, and cannot, talk about.
• Make sure all travellers are familiar with these red lines, and are empowered to be polite but firm if pressed to share more information.

Legal Compliance

There may be laws and regulations which you will need to comply with in the country you or your colleagues are travelling to. Most countries will maintain some form of export control, they may have laws which restrict their organisation’s ability to share data or project outcomes, and the legal protections around intellectual property (IP) may also differ in those jurisdictions.

Think about:

• Briefly researching the legal and legislative environment in the destination country so you can understand the legal risks to your staff and your innovation. 
• Checking whether the work conducted overseas is subject to UK or local export controls. If so, apply for appropriate licences.
•  If relevant, familiarising yourself with the IP framework and enforcement processes in the destination country. The Intellectual Property Office’s (IPO) International IP service provides specific guidance on the IP framework in a range of different countries.

Duty of care

Before travel, you should consider completing a risk assessment.  Take a proportionate approach which considers the country you are visiting and the reason for your visit. Keep this under review up to the point of departure, as well as during the trip, as the situation may change quickly.

• Make sure someone in the UK (ideally a line manager) has the traveller’s itinerary and establish check-in points throughout the trip.
• Ensure your employees know what to do and who to talk to if anything suspicious happens while they are overseas.  This could range from a contact taking an excessive interest in your company’s intellectual property, to a laptop with company data being stolen.  A positive security culture in which employees feel supported to raise any concerns will help with this.
• Nationals of a country which may not have the same legal or constitutional rights as the UK may be more vulnerable when travelling. Managers should exercise a duty of care in such circumstances where there is a risk that they may face duress.

Cyber security

When travelling overseas, it is almost certain that you will want to take mobile IT devices with you, such as a laptop, tablet and/or mobile phone. However, think carefully about the work and personal information they contain and what the impact would be if any of the devices were lost or stolen.

• Consider removing unnecessary data and files from any devices you take with you, or taking a clean device with you that only contains the information essential to the trip.
• Make sure devices are password/passcode protected and use other security features, such as fingerprint recognition. Passwords/passcodes should be unique for each account and device. 
• Many email and social media providers offer 2-step verification (2SV). Turn this on for important accounts. This makes it harder for other people to access your accounts and can provide alerts if others are attempting to access your accounts without your permission.
• Make sure that all software and apps are up to date prior to leaving the UK. If you are taking a laptop, make sure that your antivirus is turned on, USB autorun is turned off, the laptop is password protected and will not automatically connect to Wi-Fi networks.
• Make sure you know how your device will connect to both the internet and company systems when you reach your destination. If your organisation uses a Virtual 
  Private Network (VPN) or other security technology, ensure you know how it works and what to do if something goes wrong.
• Never download apps from unofficial providers, either in the UK or abroad. Unofficial app stores cannot be trusted; there is no way of knowing if the app is genuine. 
• Consider activating device-wide encryption.
• Make sure phones can be wiped if they are lost or stolen.
• Back up all your data and photos before you travel.

During your trip

The risks of international travel will vary depending on the nature of the travel. The steps taken before travelling will help manage the risks you or your colleagues are exposed to. However, there are risks you must be alive to during your trip.

In-transit

Air travel and security checks at ports mean you will not have constant control over your electronic devices and luggage. There is a risk that someone could access your devices or assets whilst you are travelling.

•  Travelling only with the information you are willing to share, both in physical and electronic formats, will reduce the risks of unintended exposure of your assets.

During your stay

• Check-in at the agreed points with a UK-based colleague. Make sure they are aware of any changes to your itinerary.
• Hostile actors could gain access to your hotel rooms, and capable actors can get into hotel safes. Hotel safes can be used for the storage of valuable items, but should not be used to store sensitive information.
• Be alive to the risks that a hostile actor could try to recruit your staff whilst they are travelling. Being approached in person or online before or after a meeting, or during a conference could be the start of a recruitment attempt. If a staff member experiences any suspicious approaches, they should let a UK-based colleague know as soon as possible.
• Public and hotel Wi-Fi connections may not be safe; carefully consider what information you might be sharing when using these connections. Avoid internet banking abroad and implement the guidance above for all other accounts.
• Consider the use of VPNs to manage communication back to the UK. However, be aware of any local rules on VPN usage, which is normally permitted but access must be provided if requested by law enforcement.

When you get back

Being security conscious does not end when you leave the country you were in. You may recognise security issues when you return to the UK.

• Let points of contact at your organisation know that you have returned safely.
• Record any incidents that occurred whilst overseas.
• Let teams know if anyone has approached you since your trip either in person or online.
• If anything indicates that your accounts or devices have been tampered with, reset passwords and supporting credentials.
• Check your possessions for signs of tampering and report any strange behaviours of electronic devices to those responsible for information security in your organisation.

It is advisable for teams to capture experiences to improve travel security procedures and support for future travellers.