explainers

How to prepare your mobile phone for the Russian border: Meduza’s complete survival guide

Source: Meduza

A growing number of Russians living overseas who return to the country temporarily are reporting psychological pressure and mobile-phone searches at the Russian border. These inspections can result in consequences far more severe than travel delays, including criminal charges and incarceration. Understanding your personal risk and exactly how to prepare your devices for the trip can be difficult, as the internet is full of fragmented and conflicting advice. Working with a lawyer and a cybersecurity expert, Meduza prepared this detailed guide answering the main questions on the topic. Is it true that FSB officers have a special machine that can find anything on a device? Do you have the right to refuse to unlock your phone, and is there any point in refusing? And what’s the most effective preparation strategy?

Listen to the audio version of this article on Radio Meduza

This article’s main takeaways

If you don’t have time to read the whole guide, if your trip is coming up fast, or if you just want to check how prepared you are, run through the experts’ advice below. If any point raises questions, the following sections explain it in more detail.

Assess your risks and prepare mentally for crossing the border

The first thing to understand is that the people who check your phone aren’t the same officers you initially show your passport to. If you raise suspicion at the passport control window, you’ll be asked into a separate room, where you’ll deal with other FSB representatives. They conduct the questioning — or “conversation” — that people who’ve been through it often informally call an interrogation. Unlike a real interrogation, a “conversation” cannot include a defense attorney, even if you have one, because at that point you’re still formally in a gray zone before crossing the border.

A phone check can come with psychological pressure. “Few people can withstand this kind of pressure,” said a lawyer who spoke with Meduza, describing the practice at the Russian border. “They scream obscenities at you, they threaten you with a treason case. And now they use this approach not just against so-called ‘foreign agents,’ but against anyone.”

The pressure, however unpleasant, eventually ends. But if security officials get into your phone, that puts you in a far more vulnerable position — information pulled from the device can be used even after you’ve left.

Hi, this is Katya, the author of this piece and an editor on Meduza’s Explainers desk — and I have something of my own to add. I put this guide together partly for personal reasons. Many of my close friends and relatives who can still travel to Russia come to me, of all people, with questions about crossing the border. I answer them, but I’ve noticed people often ignore the advice. Unfortunately, that doesn’t always end well.

If even one person who reads this piece reconsiders their plans and brings a new, well-prepared phone, I’ll know my work was worth it.

To ensure we can continue publishing journalism that will surely keep someone out of trouble, we need help, too. Specifically, from those of you who DO NOT live in Russia. Please support Meduza. If you are afraid to donate but really want to, email support@meduza.io — we will review your situation and find the safest payment method.

When is the chance of an “interrogation” especially high?

Setting aside the obvious risk groups — people who already have a criminal or administrative case against them, political activists, journalists, and public critics of the Russian authorities — those most likely to face additional screening fall loosely into several categories:

Even if none of these categories apply to you, there’s no way to know for certain whether you’ll personally run into trouble at the border, the lawyer told Meduza:

What can you check in advance to weigh your personal risks?

If you’re worried ahead of your trip, start with publicly available tools. But understand that none of these checks can guarantee nothing will happen at the border. Russian security officials don’t maintain a public database that lets you calculate every possible risk, and finding nothing in existing sources doesn’t mean no one is interested in you.

“I consider this a rule,” the cybersecurity specialist said. “If we’re not sure whether we donated or not, that means we could have. Any doubt should be interpreted in favor of the more likely risk.”

So there’s no way to know the risks for sure. Is the picture really this murky, and could I end up in prison?

Relax. It’s true that, judging by the experience of people Meduza has spoken with, the atmosphere at the border is growing more tense, and accounts of long, anxious waits and psychological pressure keep piling up. But needless panic won’t help — the chance of actually being detained is still fairly low.

“More often than not, these threats — ‘we’re going to file a report’ — don’t end with an actual one being filed,” the lawyer said. “In the last five years of my practice, that hasn’t happened, and we’ve accompanied countless people across the border. They’ve reduced people to tears and hysterics. They’ve copied phones from many people, but not a single report, no one detained, no one tortured.”

Still, don’t take this as a reason to relax completely. No one can guarantee security officials won’t act differently in your particular case — good preparation for crossing the border matters a great deal.

Learn how information can be extracted from your phone

What technology is used at the border?

In the past, checking a phone at the border mostly meant an officer manually scrolling through it — opening messages, viewing photos, checking contacts, and reviewing apps. In recent years, specialized forensic extraction systems have taken over more and more of that work: they let officers quickly copy all the data from a device and automatically search it for whatever they need.

Russian security officials use, among other tools, the Israeli-made Cellebrite UFED and the Russian-made “Mobile Criminalist” system, which serves the same purpose. Cellebrite left the Russian market back in 2021, but the Russian human rights group First Department said the devices are now bought on the black market.

These machines create a full clone of any phone connected to them — an identical digital copy. An FSB officer can then work with that copy separately from your device, but what that work looks like depends on whether the phone was unlocked.

In the first scenario, when you enter the password yourself, the program sorts through all your data on its own. It searches for Ukrainian phone numbers, the names of specific people, and mentions of organizations, and it scans call history, apps, photos, documents, and other specified markers — down to the names of Wi-Fi networks you’ve connected to. The system flags “triggers” in your phone, and you’ll have to discuss them with the FSB officer — explaining, for example, your relationship with a person deemed suspicious.

If no “trigger” goes off, don’t celebrate yet: the snapshot of your phone still gets sent on for further review. You’ll get your phone back and be let go, but something could turn up later — and what happens next depends on exactly what that is.

The second scenario — the phone connected to the system while locked — differs from the first less than you’d hope, but the outcome depends on the state of the device, the cybersecurity specialist said:

The expert said a complex alphanumeric password and a promptly updated operating system greatly increase the time it takes to crack a copy of the device. That’s exactly why there’s no point traveling with an old phone that no longer gets updates and that you “won’t miss.”

One important caveat: everything above applies to a phone that’s already been unlocked at least once after being powered on. If the device is in a BFU (Before First Unlock) state — restarted, but with the password never entered since powering on — a copy of it is practically useless to security officials, and all the data stays encrypted. But even this isn’t a universal safeguard, the specialist said: officials will try to get the password some other way.

For the BFU strategy to work, we recommend the following:

Everyone says just refuse to unlock your phone. Is something wrong with that advice?

You can refuse, but the experts Meduza spoke with advise against it.

The law does allow this. Under Russia’s Constitution, every person, regardless of citizenship, has the right to privacy of correspondence, and internal agency instructions can’t override that. The right can be restricted only by court order, meaning officials can demand your device only for an “inspection” — strictly a visual look at the device’s exterior. In practice, the term isn’t defined anywhere in law, and border officers interpret it in their own favor. That alone can make an “interrogation” drag on for endless hours: the FSB representative you’re dealing with may insist the law is on their side.

But there’s a more compelling reason not to refuse: officials will likely get the data off your phone through “Mobile Criminalist” eventually anyway, and refusing will work against you, the lawyer said:

The psychological pressure during these interrogations can be intense. Our experts have often seen cases like this in their own practice.

But if I clean my phone really well, do I have nothing to worry about?

Unfortunately, that won’t help much: it’s practically impossible to clean a phone yourself thoroughly enough to guarantee you’ve eliminated the risks. First, deleting something from a device doesn’t mean the data has vanished without a trace — it can remain in backups that security officials will also be able to access.

What’s more, most apps don’t depend on backups at all. Services like Telegram and email providers store information on their own servers, so reinstalling the app and logging back in brings the data right back to the phone. Encrypted messaging apps — Signal, for instance — are protected from this, but simply having one installed will raise suspicion.

Second, you cannot know in advance exactly what they’ll search for on your phone — or which of your old conversations, photos, contacts, or actions Russian authorities may already consider grounds for a criminal case, the lawyer said:

Your ability to clean everything thoroughly is also limited by the sheer scale of your digital footprint — including the passive kind that accumulates without your knowledge. That footprint is too vast to control fully.

Assess what they could find on your phone specifically (spoiler: more than you think)

Most people traveling to Russia limit their phone cleanup to deleting sensitive conversations, unfollowing independent media and human rights projects, and sometimes removing photos whose content leaves no doubt — a “No to War” sign, say, or a Ukrainian flag. But what security officials look for, especially with the help of “Mobile Criminalist,” goes far beyond that.

So where might they find something that creates problems for me?

First, based on the experiences of people Meduza spoke with, security officials will look at your call history and text messages, even if they’re just manually scrolling through your phone. Depending on the phone model, up to 2,000 calls — including those made through messaging apps — can be stored, and there’s generally no limit on how many texts are kept. Almost no one makes a habit of cleaning out these archives, the cybersecurity specialist said, even though they can reveal a great deal about a person.

You usually won’t find discussions of Russia’s political situation in text messages, but verification codes and notifications from banks and other services stay on the phone for years — and they can reveal where you’re registered and what bank and online accounts you hold.

Plenty of triggers for FSB officers can also turn up in your contact list. They’ll look for specific names that interest them, and for any numbers with Ukraine’s international dialing code — or any foreign numbers at all — some of which you might not even know you have.

They also examine social media and messaging apps separately, and the check isn’t limited to message content and who you follow. On Instagram, they might dig up archived stories you forgot about long ago. YouTube gives them your viewing history. On Telegram, they’ll check your cache and recent search history — people, channels, bots, even ones you don’t follow. Additional trouble can come from having given paid reactions — so-called stars — to posts by organizations whose activity Russian authorities have declared illegal.

A great deal about you can also turn up in Gmail and other email apps — documents, tickets, registration confirmations and other material that describes your life and connections in considerable depth.

Photos and screenshots are checked without fail. Officials might find pictures from pride events, say, or images featuring “banned” symbols. Modern smartphones have made this part of the job much easier for security officials, who can quickly sort through specific file categories — documents, scans, photos with text, and so on.

Finally, people traveling to Russia often underestimate how much attention foreign banking apps draw during phone checks. The lawyer told Meduza this is one of the main things security officials focus on at Russian borders now.

But if I don’t donate to any “banned” organizations, what’s the problem with foreign banks?

Beyond the formal grounds for going after you — the obligation to declare an account and report its transactions to the state — there’s a whole range of scenarios in which actions that look harmless to you can draw the attention of security officials.

“Mobile Criminalist” first automatically determines which banking apps are installed on your phone and whether they’ve been used — based, for example, on cached data. If it finds, say, Revolut, whoever’s checking will likely try to get into the app itself, too. According to the cybersecurity specialist, people often set overly simple passwords on banking apps or rely entirely on biometrics. Once security officials are into your account, they can review your transaction history — and since the list of what Russian authorities consider suspicious or illegal keeps expanding, there’s no way to know in advance which transaction will turn out to be a problem.

Rosfinmonitoring’s list of “terrorists and extremists” alone includes more than 20,000 people, and it keeps growing. What if you once had coffee with one of them and paid them back five euros for it? Or went to an acquaintance’s birthday and sent gift money to the account of someone in the group chat? There’s a chance that person, too, has been added to a list like that. The same logic applies to any transfer you’ve ever made to an organization — an environmental foundation, say; those are sometimes designated “undesirable” too. So an entirely ordinary action from the past, whose meaning has since shifted along with Russian law, can create trouble at the border.

Decide on a strategy and start preparing for your trip as early as possible

What phone should I bring?

Our main recommendation: use a different device for the trip, not your main one. You can buy something inexpensive or use an old phone — your own, a friend’s, or one of your kids’ — but if you do, reset it to factory settings first.

People Meduza spoke with call these special travel phones “vegetarian” phones, and that captures exactly what you need to do. You need to fill an empty phone — but with harmless things — so it doesn’t raise unnecessary suspicion. It’s worth taking that seriously and spending a couple of weeks on it, the lawyer said:

The system also analyzes the most popular apps, the cybersecurity specialist said: “If you have, say, Telegram installed but the cache is empty, that means you never logged in. Or you logged in, but only once, added some account, and never used it, so the cache is very small. And if there are fewer than 10 photos, or they were all uploaded on the same date, that’s visible too. There’s a whole set of things like that, and they’re very hard to fake unless you carry the phone around for two weeks, turn it on regularly, scroll through your Telegram chat list, and so on.”

How to prepare a “vegetarian” phone:

Keep in mind: if you also need to bring a laptop, reset it to factory settings too and put as little on it as possible — experts say that at the border, the device should be little more than a “typewriter.” The same recommendations apply to smartwatches and tablets, which can be searched just as thoroughly as a phone.

But what if you need data from, say, your laptop while in Russia?

Bringing a backup of that data on the trip is a bad idea — it just transfers the same risks to another device. Simply turning off syncing with your main cloud isn’t enough either, since whoever checks your devices can easily tell which cloud services you use. It’s better to make a local backup in advance, on a computer you’re not bringing, and delete the data from the device entirely. You can restore it once you’re back.

But if you really might need some sensitive files in Russia, the principle of “device separate, data separate” works. Move the files to a cloud storage service with end-to-end encryption, such as Proton Drive, Keybase Filesystem, or Tresorit. Avoid Yandex Disk, Google Drive, and other services on Roskomnadzor’s registry of companies required to store user data and turn it over to Russian security agencies. Know the password to your cloud storage by heart, and don’t keep it written down anywhere.

Once you’re across the border, you can log into the cloud if needed, download the file, work with it, and delete it from the device afterward. Keep in mind that the fact you used cloud storage at all may still be visible on the device, so deleting a file after use doesn’t erase every trace of it.

If your phone did end up in the hands of FSB officers, what should you do with it afterward?

After a phone check, two scenarios are possible. In the first, the device is confiscated — worth preparing for in advance. In the second, it’s returned to you, which isn’t the end of the story either.

General recommendations for either scenario

Once your phone has been in FSB hands, take the most urgent steps from another device you trust — a laptop, say, or a close friend’s or relative’s phone. It’s best not to touch your own phone at all during this time. The cybersecurity specialist recommends doing the following first:

What to do if your phone was confiscated

Confiscating a phone — as part of investigative operations, for example — is a separate process that must be formally documented. Demand a confiscation report and a copy of it, and insist that it list the device’s model and condition, along with the time it was taken.

Write down, or at least memorize, the position and last name of the officer taking the phone, along with when the conversation started and ended. If the officer refuses to draw up a report, note that too — it could prove useful to a lawyer you consult later.

Don’t agree to hand over passwords to accounts FSB officers didn’t already access on the device itself, and don’t read out the ones for your email or cloud services. “Unlocking your phone and handing over the keys to your entire digital life are two different things: the first doesn’t obligate you to do the second,” the cybersecurity specialist said.

What to do if your phone was returned

If your phone was unlocked and FSB officers accessed it, treat it as potentially compromised. The fact that your device was checked at all means you or people connected to you attracted attention for some reason, so once you get the phone back, don’t simply resume using it as usual.

It’s very hard to spot surveillance on your own: spyware rarely looks suspicious and usually disguises itself as a system service, which already has broad permissions anyway. Such malware can log your keystrokes and gain access to your messages, microphone, camera, and location. A compromised phone, in short, can keep collecting information about you even after you’ve gotten it back.

If you suspect an ordinary spot check, the first thing the cybersecurity specialist recommends is to restart the phone without doing anything with it beforehand — no calls, no apps, no passwords. That reduces the risk if malware that runs in the device’s memory was installed on it.

If you suspect targeted infection, it’s better not to touch the phone until someone can check it for threats. You can arrange that, but the options are limited. One tool, the Mobile Verification Toolkit (MVT) from Amnesty International, is built for specialists — it requires working from the command line and is noticeably more effective on iOS than on Android. Results can be ambiguous, and a false alarm is possible. Don’t rely on ordinary antivirus programs you can run yourself: they’re built for mass-market malware and are all but useless against targeted spyware, so a “no threats found” result doesn’t mean much in these cases.

To rule out a threat for certain, the best move is to reach out to people who do this kind of diagnostics professionally. Access Now, for instance, runs a free, round-the-clock Digital Security Helpline, including in Russian. Among other things, the organization specializes in analyzing the devices of activists and journalists.

If the phone was out of your hands for a long stretch — hours, say — or you have reason to think it was deliberately infected but can’t check it, the expert recommends abandoning the device altogether.

Keep in mind: if it’s hard to assess your personal risk, or you’ve already run into pressure at the Russian border, it’s best to consult lawyers or human rights defenders. You can reach out to the Russian independent human rights monitor OVD-Info or to the human rights group First Department. If you’re worried about your freedom after crossing the border, write to InTransit, an organization that helps people facing political persecution. For digital security questions, get in touch with Access Now.