The following is a guest post by Alex Mitchell, a cybersecurity enthusiast, WordPress guru, and data-safety tools tester with over 10 years experience.
Everybody knows Big Brother is watching. We usually imagine that surveillance happening while we sit at a desk, but business travel changes the risk. A familiar device moves through airports, hotels, conference venues, and border controls, often carrying access to company systems and sensitive information.
That does not mean every connection is hostile or every official will search a device. It means the normal safeguards around traveling employees are thinner. A traveler is more likely to use an unfamiliar network, work in public, lose physical control of a device, cross into a different legal system, or make a rushed decision while tired.
Good business trip security is therefore less about one protective app and more about a repeatable operating model. The organization decides what data must travel, prepares the device and accounts, gives the employee clear rules for the trip, and has a defined response when something unusual happens.
Why business travel increases security risk
Most security programs assume a relatively stable environment: managed office networks, known physical access, and fast support from an internal team. Travel breaks those assumptions. Devices move through spaces where shoulder surfing and theft are easier, network names can be imitated, and an urgent request may be harder to verify across time zones.
The employee also becomes a temporary custodian of more than a laptop. Authentication sessions, browser profiles, messaging history, client files, cloud access, and saved payment details can all create exposure. Even when individual files are encrypted, an already-authenticated account can be useful to an attacker.
A sensible risk assessment starts with the destination, the person’s role, the systems they can reach, and the information needed for the trip. A salesperson attending a domestic conference does not need the same controls as an engineer taking proprietary designs across a high-risk border. The goal is to match the controls to the trip without making safe work impossible.
Public Wi-Fi and the false comfort of a familiar name
Security writer Steven Petrow once described opening his inbox on an in-flight network and later being shown the emails he had sent. His account, reported by Ars Technica, remains a useful warning: a network that looks official is not automatically trustworthy.
Modern HTTPS protects much more traffic than it did when that story was published, but public networks still create risk. A traveler can join a lookalike hotspot, disclose traffic metadata, accept a malicious captive portal, or expose an application that is poorly configured. CISA recommends avoiding public Wi-Fi for sensitive activity and using cellular service when possible.
For sensitive work, a cellular hotspot is often the better choice. If company policy requires a managed VPN, connect it before opening company systems and treat the VPN as one control, not a guarantee of anonymity or safety. Keep the device firewall enabled, turn off automatic Wi-Fi joining, disable Bluetooth when it is not needed, and do not approve unexpected certificate warnings.
Physical position matters too. Choose a seat that limits screen visibility, use a privacy filter for sensitive work, and never leave an unlocked device on a table while ordering coffee or visiting the restroom. A secure network cannot compensate for an exposed screen or an unattended laptop.
Account sessions can outlive the trip
A website usually keeps you signed in with a session token stored by the browser. As MDN explains, cookies can carry session identifiers and other state. They are not simply copies of your password, but a stolen or abused authenticated session can still give an attacker access without requiring the password again.
That is why travel preparation should cover active sessions as well as credentials. Sign out of accounts that are not needed, remove personal profiles from the travel browser, and avoid sharing a browser profile across multiple people. For higher-risk trips, use a managed travel device with only the approved applications and data. The OWASP secure-cookie guidance is written for application teams, but the operational lesson is useful: session security depends on how the service and browser handle the token, not on employee vigilance alone.
After the trip, review security alerts and active sessions for important accounts. Revoke anything you do not recognize, report unusual prompts or device behavior, and let the security team inspect a managed travel device before it reconnects to sensitive environments when policy requires it.
Passwords are only one part of account protection
Reused passwords turn one breach into a route across many accounts. Use an approved password manager to generate a unique credential for every service. Do not reuse the password-manager master passphrase anywhere else, and protect the vault with strong multifactor authentication. NIST recommends MFA and explains that passkeys can resist common phishing attacks better than passwords.
Before departure, check whether work or personal addresses appear in Have I Been Pwned, but do not rely on a breach count as a risk score. A single exposed credential can matter, and an account not listed there can still be targeted. Change compromised passwords through a trusted connection and review recovery email addresses, phone numbers, and backup codes.
Where the service supports it, prefer a passkey, hardware security key, or authenticator app over SMS. Keep a recovery method that will still work if the phone is lost, but do not carry recovery codes in the same bag as the device they unlock. The company should also limit the traveler’s privileges to the systems and data needed for the trip.
Those account controls fit into a broader vulnerability management program. Patch the operating system and applications before departure, remove software that is no longer supported, and verify that full-device encryption, endpoint protection, and remote-management controls are healthy.
Local laws can turn normal online behavior into a legal risk
Security advice cannot be separated from local law. Encryption tools, online expression, photography, mapping, and access to particular services may be regulated differently across destinations. A static list of countries where a VPN is supposedly legal or illegal becomes outdated quickly and can give travelers dangerous confidence.
Research the destination before approving the trip. Start with official travel advice, the destination government, and qualified counsel when the risk is material. The U.S. State Department advises travelers to review local laws and destination-specific conditions. Its guidance for journalists is especially clear about freedom-of-expression and digital-security risks, many of which also affect researchers, executives, and employees handling sensitive information.
Martha O’Donovan, an American television producer working in Zimbabwe, was arrested in 2017 after authorities alleged that a social-media post insulted the president. The details of any case matter, but the broader lesson endures: a post that feels ordinary at home can carry a very different risk elsewhere. Current Committee to Protect Journalists guidance recommends reducing the sensitive information carried and preparing accounts and devices for the destination.
Employees need a clear escalation path, not a vague instruction to be careful. The pre-travel review should name the information that must not cross the border, the tools approved for use, who can authorize an exception, and whom to contact if local officials, a hotel, or another party requests access.
Border searches require preparation, not improvisation
Sidd Bikkannavar, a U.S.-born NASA scientist, said that border agents detained him and asked for the passcode to his work phone after he returned from Chile in 2017. The case became a prominent example because the device belonged to a federal employer and the traveler had already taken precautions. It also shows why a person standing at a border should not be expected to invent company policy under pressure.
In the United States, CBP states that electronic devices may be searched at ports of entry. Its policy distinguishes basic manual searches from advanced searches using external equipment. Requirements, consequences, and available remedies vary by citizenship, immigration status, jurisdiction, and circumstance, so travelers should obtain legal advice for their situation rather than depend on a blog post.
The safest operational move is data minimization. Carry only the files and account access required for the trip. Use a managed travel device where the risk warrants it, encrypt the device, install updates, back up necessary data, and power the device down before the crossing. Do not attempt to hide prohibited material or obstruct lawful officials.
If a device is inspected, detained, unlocked, or out of the employee’s control, the response plan should say what to do next. That may include recording the time and circumstances when safe, contacting counsel or a company security lead, rotating credentials, revoking sessions, preserving evidence, and quarantining the device from sensitive networks until it has been assessed.
A practical before, during, and after travel workflow
The strongest travel-security policy is short enough to use and specific enough to remove guesswork. It should assign decisions to named owners and capture evidence that the work was completed.
Before departure
- Assess the destination, role, data sensitivity, legal environment, and physical-security risk.
- Approve the minimum data and system access required for the trip.
- Patch devices and applications, confirm encryption and endpoint protection, and create a tested backup.
- Prepare unique credentials, MFA or passkeys, recovery options, and emergency contacts.
- Brief the employee on network rules, border procedures, local laws, and incident reporting.
During the trip
- Keep devices with you or secured, and protect screens from casual observation.
- Verify public network names and prefer cellular service for sensitive work.
- Use only approved communication, storage, and VPN tools.
- Report unexpected authentication prompts, lost equipment, searches, or requests for access promptly.
After returning
- Review account sessions, security alerts, and device behavior.
- Revoke suspicious sessions and rotate any credential that may have been exposed.
- Inspect or quarantine managed travel devices according to risk and policy.
- Record incidents and lessons, then update the travel process before the next trip.
For organizations, these controls work better as a governed process than as an employee memory test. Process Street is one Compliance Operations Platform with Docs and Ops capability areas plus built-in AI. Teams can document travel-security policy in Docs, run pre-travel and post-travel workflows in Ops, and preserve approvals, evidence, and incident records in one system.
Travel will always involve uncertainty. A proportionate, practiced workflow reduces the avoidable risk while giving employees a clear way to keep working and ask for help.