Lesson 5 of 9 · about 16 minutes
Device Security: Updates, Locks, Encryption and Travel
You'll be able to
- Turn on automatic updates and explain why patch speed matters
- Choose a screen lock and show why a longer PIN is much harder to guess
- Confirm full-disk encryption on Mac, Windows, iPhone and Android
- Write a lost-device plan and a travel plan, including border searches
Your phone holds your email, your notes, your recordings, your contacts and the codes that open everything else. Your laptop holds the drafts. Device security comes down to four habits: keep them updated, keep them locked, keep them encrypted, and know what you will do the day one goes missing.
Updates are the cheapest security you will ever get
When Apple, Google or Microsoft ships a security update, the release notes describe the flaw it fixes. Attackers read those notes too and build tools against people who have not updated. The gap between a patch and widespread attacks can be days. So the right setting is automatic, everywhere:
- iPhone and iPad: Settings, General, Software Update, Automatic Updates. Turn on both download and install, and the security responses option.
- Android: Settings, System or Security, then system updates and Google Play system updates. Update apps automatically in the Play Store.
- Mac: System Settings, General, Software Update, Automatic Updates.
- Windows: Settings, Windows Update. Leave it on and restart when asked.
- Browser: Chrome, Firefox, Edge and Safari update themselves, but only when you restart them. If your browser has been open for three weeks, restart it now.
A device that no longer gets security updates is a liability for sensitive work. Check whether your phone's maker still supports it. If not, use it for music and buy a supported one for reporting.
Screen locks: the math of a PIN
Example: how many guesses
- A four-digit PIN has 10 x 10 x 10 x 10 = 10,000 possible combinations.
- A six-digit PIN has 10 to the sixth power = 1,000,000. That is 1,000,000 / 10,000 = 100 times as many.
- An eight-character alphanumeric passcode using lowercase letters and digits (36 symbols) has 36 to the eighth power, about 2.8 trillion.
Phones also slow down or block repeated wrong guesses, which helps. But people pick patterns like 1234, 0000, birth years and the bottom row of the keypad. A random six-digit PIN is the minimum. An alphanumeric passcode is better if your work is sensitive.
Set the auto-lock to one or two minutes. Fingerprint or face recognition is fine for daily convenience. Know how to disable it quickly, though. On an iPhone, holding the side button and a volume button brings up the power-off screen and requires the passcode next time. Android phones have a Lockdown option in the power menu on many models.
Hide message previews on the lock screen. A tip that pops up on a locked phone sitting on a café table is not a secret anymore.
Full-disk encryption
If your laptop is stolen from a car, encryption decides whether the thief gets a used computer or your sources' names. Check each device:
| Device | Feature | On by default? | Where the recovery key lives |
|---|---|---|---|
| Mac | FileVault | Apple silicon and T2 Macs encrypt automatically; turning FileVault on makes your login password required to read the disk | Your iCloud account or a recovery key you write down |
| Windows 11 Home | Device Encryption | Turns on at setup with a Microsoft or work account on supported hardware; not with a local account | Attached to your Microsoft account |
| Windows 11 Pro | BitLocker | Device Encryption may be on; full BitLocker you turn on | Microsoft account, a file, or printed |
| iPhone | Data protection | Yes, once a passcode is set | Your passcode |
| Android | Device encryption | Yes on current phones with a screen lock | Your screen lock |
Sources: Apple on FileVault, Microsoft on Device Encryption.
Find My, theft protection and the lost-device plan
Turn on Find My (Apple) or Find Hub (Google) now, while you still have the phone. Then add the extra theft protections both companies have built.
- iPhone, Stolen Device Protection (iOS 17.3 or later). Away from familiar places, using saved passwords and credit cards needs Face ID or Touch ID with no passcode fallback. Changing your Apple Account password also means waiting an hour and then passing a second Face ID or Touch ID check (Apple). This defeats the thief who watches you type your passcode in a bar, then grabs the phone.
- Android theft protection. Theft Detection Lock locks the screen if the phone is snatched and carried off. Offline Device Lock locks it if it is cut off from the network. Remote Lock lets you lock it from android.com/lock with your phone number. Find these under Settings, Google, All services, Theft protection. Some features need Android 15 (Google).
Example: the one-page lost-device plan
Write this on paper and keep a copy at home and one with a trusted person.
- From another device, go to icloud.com/find or google.com/android/find. Mark the phone lost and display a contact number.
- If it holds sensitive material and recovery looks unlikely, erase it remotely.
- Call the carrier to suspend the line and confirm the SIM lock is on (lesson 3).
- From a computer, sign out of all sessions on email, Signal (unlink devices), social accounts and the password manager.
- Change the passwords for email and the password manager if the phone was open when taken.
- Warn sources through another channel if the phone held their messages.
- File a police report if you need one for your carrier or a claim.
Lockdown Mode, for the few who need it
Apple's Lockdown Mode is an "extreme" setting for people who may be personally targeted by sophisticated spyware (Apple). It blocks most message attachment types and link previews, blocks FaceTime calls from people you have not called in the last 30 days, and requires the phone to be open before it connects to a computer or accessory. Most writers do not need it. A writer investigating a powerful agency or working with sources in another country might. It is free, so if your threat model from lesson 1 puts a well-funded adversary near the top, try it for a week.
Travel and border crossings
Travel puts devices at risk from theft, loss and search. U.S. Customs and Border Protection claims authority to search phones and laptops at the border. According to a July 2026 summary by the law firm Steptoe of CBP Directive 3340-049B (January 2026), a basic search, a look through what is on the device, needs no suspicion. An advanced search, connecting equipment to copy or analyze the contents, requires reasonable suspicion or a national security concern and supervisor approval. Officers are told to turn off network connections first, and cloud data generally needs a warrant or consent. The same summary reports 55,318 device searches in fiscal year 2025, up from 47,047 the year before. Those figures come from a secondary source; CBP publishes its own statistics on its border search page. Rules in other countries differ and are often looser.
| Before the trip | During | After |
|---|---|---|
| Back up everything; take only the files you need | Keep devices on your body or locked away, never in checked bags | Change passwords you typed on hotel or shared computers |
| Consider a travel phone or laptop with minimal data | Power devices fully off before a border crossing, so encryption is at full strength | Review account activity for logins you did not make |
| Sign out of apps holding source material | Use your phone's hotspot instead of hotel Wi-Fi when you can | If a device was taken out of sight, treat it as suspect and consider resetting it |
CPJ's Digital Safety Kit has a crossing-borders section written for reporters. Read it before any international reporting trip.
Common mix-ups
- Claim: "Updates slow my phone down, so I skip them." What the evidence shows: Security updates fix flaws attackers are actively using. A slightly slower phone beats a compromised one.
- Claim: "Deleting files before a border crossing makes them gone." What the evidence shows: Deleted files can remain in backups and synced services, and forensic tools can recover some of them. Leaving the data at home is the reliable method.
- Claim: "Face ID means I don't need a strong passcode." What the evidence shows: The passcode is the fallback that opens everything, and a watched passcode is how most phone thefts become account thefts. That is the exact problem Stolen Device Protection was built for.
Checklist
- Automatic updates on for phone, laptop and apps; browser restarted
- Six-digit or longer passcode; auto-lock two minutes or less
- Lock-screen message previews hidden
- FileVault, BitLocker or Device Encryption confirmed on; recovery key stored
- Find My or Find Hub on; Stolen Device Protection or Android theft protection on
- Lost-device plan written and stored in two places
Try it
Spend 30 minutes auditing every device you use for writing. For each, record the operating system version, whether automatic updates are on, the screen lock type and timeout, and whether disk encryption is confirmed. Fix anything missing. Then write your one-page lost-device plan using the example as a template, test step 1 by locating your phone from another device, and give a copy of the plan to someone you trust.
Check yourself
1. How many possible combinations does a six-digit PIN have compared with a four-digit PIN?
Four digits give 10,000 combinations; six digits give 1,000,000. That is 100 times as many.
2. What does Apple's Stolen Device Protection add when the iPhone is away from familiar locations?
It blocks a thief who has watched you type your passcode from changing your Apple Account password or using saved passwords without your biometrics, and adds about an hour's delay to critical changes.
3. On Windows 11 Home, when does Device Encryption usually turn on by itself?
Microsoft says Device Encryption turns on during setup or first sign-in with a Microsoft or work account, and the recovery key is attached to that account. Local accounts do not get it automatically.
4. Under CBP's directive as summarized in this lesson, what can a basic border search of a phone look at?
Basic searches review what is on the device. Officers are told to turn off network connections, and cloud data generally needs a warrant or consent.
5. What is the main reason to have a lost-device plan written down before anything happens?
Speed matters. A written plan lists the Find My or Find Hub steps, the accounts to sign out and the numbers to call.
6. Who does Apple say Lockdown Mode is designed for?
Apple calls it an optional, extreme protection for people who, because of who they are or what they do, may be targeted by rare, sophisticated attacks.
Terms in this lesson
- Patch
- A software update that fixes a security flaw or bug.
- Full-disk encryption
- Scrambling everything stored on a device so it is unreadable without your password or key.
- Recovery key
- A long code that can open an encrypted disk if you forget your password. Lose both and the data is gone.
- Remote wipe
- Erasing a lost device over the internet using a service like Find My or Find Hub.
- Border search
- An inspection of belongings, including phones and laptops, by customs officers when you enter a country.
Sources
- Apple, About Stolen Device Protection for iPhone checked 2026-10
- Apple, About Lockdown Mode checked 2026-10
- Apple, Protect data on your Mac with FileVault checked 2026-10
- Microsoft, Device Encryption in Windows checked 2026-10
- Google, Protect your data if your device is lost or stolen (theft protection) checked 2026-10
- Steptoe, Navigating U.S. Border Searches of Electronic Devices (July 2026) checked 2026-10
- Digital Safety Kit, Committee to Protect Journalists (Crossing borders section) checked 2026-10