Protecting yourself: measures by risk dimension

Border device risk

How likely is my device to be searched, imaged, or seized at the border, and can I be compelled to unlock it?

A border device search is a custody problem: the hardware is in someone else's hands, and the owner is standing there to be asked for the passcode. Three separate things can happen, and they call for different defences: an officer scrolls through the device at the counter, the device is imaged with a forensic tool, or it is taken away and returned hours or days later. Encryption of traffic in flight has no bearing on any of the three, because the data at issue is at rest on hardware the traveller no longer controls.

Powered down before the queue: A device that has been fully powered off sits in a before-first-unlock state with the file encryption keys absent from memory, while a locked device that has been unlocked since boot still holds them, and extraction tools have consistently done better against the second case (the Cellebrite support matrices published by 404 Media in 2024 set out the gap by operating system version; iOS 18.1 added an inactivity reboot that returns an idle device to the before-first-unlock state after 72 hours). The cost is practical, since a powered-down phone produces no boarding pass and no authentication code until it has been booted and unlocked again. This changes what an extraction can yield rather than whether the device is taken, and the benefit ends the moment the passphrase is typed in front of an officer.
Passphrase over biometric unlock: Two things separate a long alphanumeric passphrase from a face or a fingerprint: brute force against a six-digit PIN is tractable for a forensic tool while a passphrase is not, and several jurisdictions treat compelled biometric unlock differently from a compelled passcode (the US Ninth Circuit held in United States v Payne (2024) that pressing a thumb to a sensor did not implicate the Fifth Amendment, while compelled disclosure of a passcode remains contested). The cost is friction at every unlock and exposure to anyone watching the screen. Where refusal to hand over a password is itself an offence, as under Schedule 7 of the Terrorism Act 2000 at UK ports, the legal distinction buys nothing.
A device that carries less: A separate travel phone or laptop limits what a full filesystem extraction can produce, because the limit is what the hardware holds rather than what a policy says an officer may examine. It costs money and a day of setup, and a device with almost no history reads as unusual in a secondary inspection. It does no work for the accounts signed into after arrival, which repopulate the device with the material left at home.
Accounts signed out before the crossing: Extraction recovers authentication tokens as well as files, so a signed in mail or storage client on a seized device can expose an archive far larger than the device itself holds. Signing out and removing the client narrows the exposure to the local copy. The cost falls on re-authentication: where the second factor lives on the same device, the event that exposes the accounts also locks the traveller out of them.
Where the backups sit: An automatic cloud backup places a copy of the device contents under a jurisdiction the traveller may never enter, reachable by legal process that has nothing to do with the border crossing. A local encrypted backup keeps the copy under the traveller's own control and makes protecting it their responsibility. The trade is a real one: a seized device with no recent backup is an outage measured in days, and some platforms disable or degrade sync features when cloud backup is switched off.
A device that left the room: Once hardware has been out of sight, the question shifts from what was copied off it to what may have been placed on it, and a visual inspection on return will not answer that. Rebuilding from known-good media, rotating every credential entered on the device, and retiring the hardware are the available responses, in ascending order of cost. This is the most expensive item here and the one whose benefit is hardest to observe, since a competent implant produces no symptom the owner would notice.

What does not help

A VPN protects traffic in transit from a network observer, and that is the whole of what it does. At a border crossing the device is in someone else's hands and the data is at rest, with the VPN client and its configuration sitting inside the same encrypted volume being examined, so running one changes nothing about the result of a search or an extraction. The second is deleting files, chats or apps in the departure lounge, which fails twice over: a full filesystem extraction recovers database remnants and system artefacts that survive an in-app delete, and the same messages sit in cloud backups and on the other participant's device, both beyond the traveller's reach. In some jurisdictions the deletion creates a problem of its own, because misleading an examining officer about what a device contains is a separate offence from anything the device held.

Surveillance and interception

How comprehensively are communications intercepted, retained, and monitored, and is commercial spyware in use?

For most visitors the exposure here is ordinary and automatic: which IMSI attached to which cell at which time, which numbers were called, which servers were reached, retained under whatever local rule applies and available to whoever can compel the operator. Targeted commercial spyware is the rarer and more serious case, and it changes the problem, because an implant reads messages on the device after the application has decrypted them. Encrypting the channel addresses the first and does nothing about the second.

End-to-end encrypted messaging, and the record it still leaves: An end-to-end encrypted messenger denies a network interception point the content of a message, which is the part that bulk collection at an operator or exchange point reads in plain text for SMS, voice and unauthenticated email. It does not conceal that two accounts communicated, when, or from which cell, and retention regimes reach that metadata directly: section 87 of the UK Investigatory Powers Act 2016 allows a notice requiring an operator to retain communications data of that kind for up to 12 months. The cost is coordination: the protection exists only where both parties use the same tool, and a silent fallback to SMS or a carrier call removes it without announcing that it has.
A travel number kept apart from account recovery: Buying a local SIM binds a number to a passport at the point of sale wherever registration is mandatory, and roaming on a home SIM still exposes the IMSI, cell location and any unencrypted traffic to the visited operator. Carrying a number separate from your primary one limits how much of an existing contact graph is reachable from local records, at the cost of breaking whatever depends on the primary number: banking checks, SMS second factors, contact discovery in messengers. An eSIM bought from a foreign provider changes the billing relationship and not the radio, so the visited network still sees the device attach and can place it.
Platform lockdown modes: iOS Lockdown Mode and Android's Advanced Protection disable the attack surface that Citizen Lab and Amnesty International's Security Lab have repeatedly found in zero-click chains: complex attachment parsing in messaging, browser JIT compilation, calls and invitations from unknown accounts, and wired data connections while the device is locked, with the Android mode also refusing 2G, the downgrade an IMSI catcher depends on. The cost is daily friction: link previews that fail, sites that break, accessories that stop working. Neither removes an implant that was installed before the mode was turned on.
Scheduled reboots: Several of the iOS and Android implant families examined by Amnesty International's Security Lab hold no persistence across a restart, so rebooting on a schedule ends that class of infection and forces the operator to spend another exploit chain to come back. The cost is minutes, plus anything that assumed the device stays up. It prevents nothing: reinfection can follow within the hour, persistent implants survive, and the reboot clears volatile evidence that a later forensic examination would have wanted.
Second factors that do not travel over the mobile network: SMS one-time codes pass through the visited operator and through interconnect signalling, where SS7 and Diameter access allows interception and redirection; NIST SP 800-63B has designated out-of-band authentication over the public telephone network, which includes SMS, a restricted authenticator since revision 3 in 2017. Hardware security keys and app-based TOTP take the code off that path, so a visited network with full sight of your SMS still cannot complete a login. The cost is recovery planning, because a single key lost abroad locks the account, and this works only where a second key or a set of recovery codes is held somewhere you are not.
Tunnels and encrypted DNS, and where the observation moves to: A tunnel terminating outside the country, with encrypted DNS and TLS Encrypted Client Hello, denies the local operator the hostnames and payloads it would otherwise log, leaving it the timing, the volume and the fact that a tunnel exists. Encrypted Client Hello conceals the server name only where the destination supports it, so that part of the coverage is partial. The observation point moves to the tunnel provider, whose retention policy and jurisdiction become the thing being trusted; nothing is deleted, it is relocated. The cost is a subscription or an endpoint you maintain yourself, added latency, and services that refuse connections arriving from known tunnel ranges. Where tunnel use is restricted or unusual (see the encryption and VPN legality dimension) the connection is itself a signal, and commercial endpoint ranges are blocked or throttled in several of the countries where the measure would matter most.

What does not help

A VPN answers a narrow slice of this dimension: it changes who can read your traffic and stops there. An implant on the device reads messages after the application has decrypted them, and no tunnel conceals that a handset attached to a particular cell at a particular time, which is the record most interception regimes actually reach. Turning off location services addresses something different again. That setting governs what applications may ask the operating system for, and has no bearing on the location trail the mobile network builds from attachment and handover, which the operator produces and holds whatever the handset is set to.

Encryption and VPN legality

Are VPNs and strong encryption lawful, and can I be required to install an application or hand over keys?

This dimension is about whether the tools you already carry are lawful where you are going, and whether an official can require you to unlock a device, hand over a key, or install an application before you are admitted. The exposure is legal and administrative rather than cryptographic, so no choice of cipher or provider answers it. A VPN that connects on arrival tells you the tool is not blocked and nothing else: some jurisdictions license VPN provision rather than prohibiting use, and some attach the penalty to the purpose of the connection rather than to the protocol.

An installed-application inventory: Reviewing what is on the device before departure addresses the case where possession or use of a tool is itself an offence or requires a permit, which is a separate question from whether its traffic is blocked. Removal is partial: app store purchase history, the provider's own account records, and an identity-verified local SIM all tie a person to prior use, and a restored backup reinstalls what was taken off. The cost is rebuilding a working device, and losing tools you may want if the local network turns out to be hostile.
Transports that do not announce themselves: Obfuscated transports (TLS-camouflaged protocols such as VLESS with REALITY, Shadowsocks with a plugin, Tor bridges over obfs4 or WebTunnel) address detection by deep packet inspection and by the handshake fingerprinting that national blocking systems use. They change nothing about legality: where circumvention is the offence, evasion that works is the offence being committed, and traffic volume and timing still stand out to an operator who analyses flows rather than signatures. The cost is fewer providers, lower throughput, and more configuration that can be got wrong under pressure.
A route with a lawful basis: Corporate access back to an employer's network is treated separately from consumer circumvention services in several regimes; China's 2017 MIIT notice requires cross-border VPN operators to hold a licence while leaving leased lines available to registered enterprises. A route of that kind gives the traffic a purpose that can be explained at an interview, which is where the question is usually decided rather than in a packet capture. It requires an employer willing to arrange it, it exposes your connection metadata to that employer, and it covers nothing you do outside the tunnel.
Unlock method and compelled disclosure: Powering a device fully down before any encounter and unlocking it only by passphrase addresses two distinct things: a device in its before-first-unlock state withholds keys that a device unlocked since boot has already loaded into memory, and passphrases have received different treatment from biometrics in some courts (the Ninth Circuit in United States v Payne (2024) held a compelled thumbprint unlock was not testimonial, while the Pennsylvania Supreme Court in Commonwealth v Davis (2019) held compelled passcode disclosure was). The cost is a device that has to be booted and typed into before it can produce a ticket or a code, and a passphrase entered wherever you happen to be standing. Key disclosure statutes bind whoever is present, not citizens alone: section 49 of the UK Regulation of Investigatory Powers Act 2000 and Article 434-15-2 of the French Code pénal each attach a criminal penalty to refusal. Where such a statute applies, a passphrase moves the exposure from forensic extraction to prosecution rather than removing it.
A device prepared for mandated installation: Some entry and licensing regimes require software or a certificate to be installed as a condition of access: Kazakhstan's 2019 requirement that subscribers install a national root certificate for HTTPS interception, and the BXAQ (Fengcai) Android application installed at Xinjiang land crossings, reported in 2019 by Süddeutsche Zeitung and the Guardian with technical analysis published by Cure53 and the Citizen Lab. A device that accepts either should be treated as untrusted from then on, because a root certificate breaks TLS verification for every site until it is removed and an installed application's access does not lapse when you leave the checkpoint. Carrying a device you are willing to retire keeps that requirement away from a primary device, at the cost of buying, provisioning and later disposing of a second one.
Less on the device to decrypt: A decryption demand reaches what you hold, so material left on infrastructure you cannot reach from inside the country, or behind a second factor you did not bring, is outside what you can be made to produce. The trade is real: retrieval after arrival depends on a working channel that the same restrictions may deny, and an account you cannot open is an account you cannot work from. A synced cloud backup undoes the measure, since the copy stays reachable through the provider whatever state the device is in.

What does not help

A no-logs VPN provider addresses what can be extracted from the provider, which is not the demand you face here. A demand made to a traveller is answered by that traveller, and the fact that an encrypted tunnel was opened to a known endpoint is visible to the local network operator regardless of what the provider retains. Hidden volumes and decoy profiles (a VeraCrypt hidden volume, a second Android user profile) assume an adversary who stops once the visible data looks plausible, and they leave partition sizes and file timestamps that forensic tools compare. Where refusal to decrypt is itself an offence, an official who is unconvinced can maintain that a key exists and has been withheld, and the penalty attaches to that.

Network threat

How hostile is the network environment to a foreign visitor, from state actors and criminals alike?

Network threat is the risk that the infrastructure you connect through is run by, or reachable by, someone with an interest in you: the hotel and conference wifi, the mobile operator you roam onto, the transit networks your traffic crosses on the way out of the country. The familiar framing, that public wifi lets a stranger in the lobby read your passwords, describes a problem that widespread TLS largely closed; what remains is metadata visible to whoever runs the network (which services you contact, from where, and when), the ability to interfere with anything unauthenticated, and network position as a delivery route for targeted device compromise. The first two apply to every visitor; the third applies to the smaller number of people worth spending an exploit chain on.

Your own uplink rather than the venue's: A roaming eSIM from your home operator moves traffic off wifi the venue controls, and where the plan is home-routed it also carries that traffic out of the visited country's fixed networks before it reaches the internet. Most travel eSIM resellers do not disclose whether a given plan is home-routed or broken out locally, and researchers at Northeastern University, presenting at USENIX Security in August 2025, bought profiles from 25 providers and found the actual routing was often neither: one Ireland-registered eSIM was carried through China Mobile's Hong Kong network, making the device appear to be located in China. Either way, the visited mobile operator sees the device attach, its approximate location and its signalling. The trade-off is roaming cost; a locally bought SIM is cheaper, and where registration is mandatory it ties the number to your passport.
A tunnel to an egress you choose: A VPN or a personal WireGuard endpoint denies the local network the destination addresses, DNS queries and TLS server names it would otherwise see, and removes its ability to inject into unauthenticated traffic. It relocates that visibility to the tunnel provider and to whatever jurisdiction the exit sits in, which is a change in who observes you rather than a removal, and the fact that a tunnel is in use stays visible to the network even when its contents are not. The cost is a subscription or an endpoint you maintain, throughput and latency, and the services that refuse traffic from known VPN ranges. Some countries restrict VPN use or require a licence for it, which is scored under encryption and VPN legality, and no tunnel helps once the device at the near end is compromised.
Root certificates and applications a network asks you to install: A captive portal or guest network that asks for a certificate profile or a client application is asking for the ability to read TLS traffic from that device, and an installed root certificate keeps that ability after you leave the country until it is removed. Declining usually means not using that network. Certificate pinning in a small number of applications resists an installed root; browsers do not, so anything done in a browser is readable to whoever issued the certificate.
Radio settings that close the cheap attacks: Disabling 2G removes the downgrade step that cell-site simulators use to force weak or absent encryption, exposed as a setting on Android and available on iPhone only inside Lockdown Mode. Removing saved open networks, the hotel, airport and conference SSIDs that carry no password, stops the device joining an access point that has taken the same name; a network with a password resists the same trick on its own, because the impostor cannot complete the handshake without the key. The cost is losing service in the few areas where 2G is the only coverage, and joining open networks by hand everywhere else.
Hardened device modes and a current patch level: Apple's Lockdown Mode and Android's Advanced Protection cut the surface that network-delivered exploit chains use: message attachment handling, just-in-time compilation, wired accessory access while locked, and sideloading. Citizen Lab has reported cases in which Lockdown Mode blocked an attempted mercenary spyware infection, which makes it one of the few consumer settings with observed effect against that class of attack. The cost is functionality that visibly stops working, and neither mode substitutes for patching, because a chain reused after its bugs are disclosed works only against a device that has not taken the fix.
Credentials that survive interception: Passkeys and FIDO2 security keys are bound to the origin they were registered against, so an injected or imitated login page collected on a hostile network has nothing replayable to steal, while SMS one-time codes remain interceptable through operator signalling. Enrolment has to happen before departure, and a second key or a set of recovery codes has to be left somewhere you are not going, because losing the only token abroad locks you out of the accounts you depend on most. Neither protects a session token lifted from a device that is already compromised, which is why this sits behind patching rather than in front of it.

What does not help

Private browsing mode and the padlock in the address bar are both read as network protection, and neither is. Private browsing clears local history and changes no packet that leaves the device. TLS conceals what you send but not who you contact: DNS queries and the server name in the handshake stay visible unless encrypted DNS and Encrypted Client Hello are both in use and the destination supports them, and destination IP addresses stay visible regardless. Mobile antivirus is the third. On iOS and current Android, one application cannot inspect another application's memory or files, so a scanner has no view of the exploit chains this dimension is about; what it can detect is phishing links and known-bad applications, which is a different problem from a hostile network.

Speech and legal exposure

What legal risk attaches to what I have said online, or say while I am there?

Speech risk attaches to a record, not to a conversation. The exposure that matters is usually something already published under the name on the passport, indexed and reachable by whoever reviews a visa application or an entry queue, and arriving in a jurisdiction changes what that state can enforce rather than what you have said. Treating this as a question of discretion during the trip misplaces most of the risk, which was fixed before departure.

An inventory of what is already published: A search of your own name, handles, bylines, and signatures on public letters shows approximately what a screener sees for the same effort. It costs an afternoon and changes nothing about the exposure itself, which is the point: it converts an unknown into something you can weigh against the trip. It stops at the edge of open sources, so it says nothing about what a platform would produce under legal process or what a state already holds.
Deletion, and what survives it: Removing a post lowers the chance that a keyword search of open sources returns it, which is the check a visa reviewer or an officer at a counter has time to run. It does not reach web archives, other people's screenshots, syndicated copies, or a file already assembled on you, and deletion timed after a visa application or after an official complaint can itself be treated as tampering. The cost is the permanent loss of your own record and a conspicuous gap where an active account used to be.
Pseudonymity, and when you are asked to declare it: An account is tied to a person by recovery email, phone number, payment method, and follower overlap long before the display name matters, so a separation improvised before a trip rarely holds while one maintained for years often does. The US DS-160 visa application has required applicants to list the social media identifiers they have used in the previous five years since the State Department expanded the form in 2019, which places a pseudonymous account inside a question whose false answer is an offence in itself, provable from the form without the state establishing anything about what was said. The cost is upkeep: a recovery address, a payment method and a number kept apart for as long as the account exists, and no crossover of contacts between the two identities.
The archive that travels with you: Drafts, saved posts, channel memberships, and group chat history held on a device can supply evidence for a publication or association offence, including for material that was never published. Carrying less of your own archive reduces what an inspection can produce, at the cost of losing access to your own material while away. It does nothing about the server-side copy, which an account compromise or a legal request to the platform reaches without touching your luggage.
Publishing while inside the jurisdiction: A post made, a panel remark, or a quote given to a local outlet while present is the easiest category to prove and the only one where the act occurs squarely inside the state's territory. Declining to publish for the duration removes that category entirely, at whatever professional cost silence carries for the work you are there to do. Prior publication is unaffected, and presence can be what makes a prior post enforceable against a person the state previously could not reach.
Speech attributed to you by other people: Being tagged, quoted, added to a group, or listed as a signatory creates exposure you did not write and cannot delete. Asking collaborators to hold attribution until after the trip, and leaving groups whose traffic you would not want read as yours, covers part of it. Both require telling other people that you are travelling and when, which is itself information you may not want distributed.
Someone who notices you have stopped checking in: None of the measures above changes an outcome once a person has been detained; what changes it is the interval before a lawyer, an employer's legal contact, or a consulate learns of it. A check-in schedule with someone holding your itinerary and the number of counsel costs one arrangement and no technical work. It offers a dual national considerably less, because a state that treats the traveller as its own national, as China and Iran do, can refuse consular access altogether.

What does not help

A VPN or Tor conceals the network a post was sent from. The evidence in a speech prosecution is normally the post itself, published deliberately, attached to an account the state can already associate with a name, so hiding the connection defends a step that no one needed to attack. Connection privacy matters for source protection and for anonymous publication maintained over time, and it does nothing for material already attributed to you. Making an account private, or moving the conversation to an end-to-end encrypted messenger, reduces the audience without reducing the number of copies. Every existing follower keeps access and can screenshot, the platform still holds private posts and can be compelled to produce them, and in an encrypted group each participant holds a complete readable copy that they can hand over voluntarily or under compulsion. Encryption governs who can read a message in transit, not who can testify to what it said.

Data jurisdiction

What happens to corporate or client data I carry into the jurisdiction?

Data jurisdiction risk is about legal reach over data rather than technical interception of it. The question is what the host state can lawfully compel, from you, from a local entity, or from a provider with staff or infrastructure there, and separately what duties you breach by taking the data across the border at all. Data left in the cloud has still travelled: an account you can open from a hotel room is present in that jurisdiction in every way that matters, and a device search that recovers a live session reaches the mailbox behind the handset.

An inventory of what your credentials can reach: The exposure is the set of data retrievable with the credentials you carry, which is usually far larger than what sits on the disk: a synced mailbox and its archive, a shared drive root, a password manager vault, delegated access to someone else's account. Compiling that list takes an afternoon and access to an admin console, and it goes stale the moment someone changes a sharing setting, so it carries the date it was made. It sizes the problem and does not reduce it.
Reduced entitlement rather than a cleaned device: Deleting files from a laptop achieves little while the account still resolves them from anywhere. Removing group memberships, revoking delegated access and provisioning a travel account holding only the trip's material changes what any credential can reach, including one obtained by compulsion or lifted from an imaged device. The cost is administrative: someone makes the changes, something usually breaks, and someone restores access on return, so it works when planned days ahead and not at the airport.
Token lifetime, and rotation on return: Refresh tokens and session cookies stored on a device are bearer credentials, so an imaged laptop can yield working access long after the machine is handed back, and full-disk encryption does not prevent this on a device seized while running or suspended with keys in memory. Signing sessions out server-side, shortening token lifetimes and rotating credentials after travel closes that tail, at the price of repeated re-authentication during the trip. None of it touches data already copied.
Which jurisdictions your provider answers to: Where data is stored is part of the answer; whose legal process the provider must answer is the rest. The US CLOUD Act of 2018 allows US authorities to compel US-based providers to produce data in their control irrespective of storage location, the UK-US Data Access Agreement in force since October 2022 carries orders in both directions, and Regulation (EU) 2023/1543 creates European Production Orders servable on a provider's designated establishment in another member state, applying from 18 August 2026. Reading a provider's law enforcement guidelines and government request reporting takes an hour and informs which provider you choose, not what the provider you already use is obliged to hand over.
The obligations that run outbound: Carrying client, patient or commercially controlled data into a country can breach duties you already owe, independently of anything the host state does: Chapter V of the UK and EU GDPR governs transfers to third countries, professional confidentiality and legal privilege bind lawyers and clinicians wherever they are working, and export control on technical data can require authorisation before controlled material leaves, subject to the tools of trade provisions of License Exception TMP under the US Export Administration Regulations. Establishing which apply is legal work with a lead time, and an answer arriving after departure is worth little. Compliance here answers to your regulator and your client, and not at all to the host state.
A record of what crossed the border: If a device is seized, imaged or lost, the question within days is what was exposed, and a defensible answer needs a record made before departure: which accounts were signed in, which datasets were reachable, which categories of personal data were in scope. Article 33 of the UK and EU GDPR allows 72 hours from awareness to notify a supervisory authority, and client contracts often allow less. The cost is an hour before each trip, and redoing it whenever entitlements change. The record is sensitive and may itself be disclosable, so it sits with your other incident material, and it prevents nothing.

What does not help

Carrying an empty laptop and leaving the data in the cloud. The data becomes reachable the moment you sign in from inside the jurisdiction, it renders into memory, caches and thumbnails on the device you carried, and the credentials on that device are precisely what an examiner or a production order wants. A search that recovers a live session recovers the corpus behind it, so an empty disk moves the exposure rather than removing it. Full-disk encryption combined with a VPN. Full-disk encryption protects data at rest on a powered-off device against an examiner without the passphrase, and a VPN protects traffic in transit from the local network operator. Neither answers the legal question: an order served on your employer, on your provider or on you, or a request you decide to comply with, produces plaintext regardless of how the bytes were protected in storage or on the wire.

Connectivity continuity

How likely am I to lose access to the internet, or to the specific tools I depend on?

Continuity risk is the loss of access to the network or to a specific tool, running from a national shutdown down to one messaging application being blocked or one account being locked because the login arrived from an unexpected country. Censorship is the visible part of it. For most travellers the disruption arrives through their own dependencies: the authenticator, the password vault, the booking, the bank's approval prompt, each of which needs the connection that has just gone. It is not a confidentiality risk, and several measures that protect confidentiality make continuity worse, because each one adds another thing that has to work.

Offline copies of what you need to move: A shutdown or a blocked service removes access to whatever lives only in a browser tab: boarding passes, visa approvals, insurance policy numbers, the address you are going to, the number of the person meeting you. Copies held on the device or on paper survive that, at the cost of putting the same information where a border search reads it, so this measure and border device risk pull against each other. Offline copies stop helping where the counterparty needs a live check, such as an airline scanning a barcode against a system that is itself offline.
Authentication that survives the loss of a network: Time-based one-time codes are computed on the device from a stored seed and work with no connectivity at all, while SMS codes fail the moment the mobile network does and push approvals fail without a data connection. The cost is that the seed and any printed recovery codes are bearer credentials travelling in your luggage, which is a different exposure from the one you removed. Neither form helps when the service itself is blocked at the network, or when the provider locks the account because the login came from an unfamiliar country.
A second path to the network, chosen for independence: A second SIM or eSIM on a different operator covers single-operator outages, congestion, and filtering applied at one carrier's resolvers or transit. It does not cover a national shutdown, which is ordered against every licensed operator at once, and in countries with SIM registration it costs a second subscriber identity recorded against your passport. Where the second path is a travel eSIM reseller rather than a second physical SIM, the diversification can be illusory: the same 2025 USENIX Security research found that becoming a wholesale eSIM reseller requires only an email address and a payment method, so two differently branded eSIMs can sit on the same underlying network without disclosing it. eSIM profiles are provisioned over the internet, so a profile intended to be installed once the outage starts is a profile that may not install.
Locally cached tools, including their licence checks: Offline maps, downloaded documents, a local clone of the repository, and a translation model that runs on the device allow work to continue through an outage. Applications that validate a subscription or fetch configuration at launch will fail regardless of what is cached, and the way to find out which ones do is to run them with the radios off before departure. Cached copies also diverge, so edits made offline have to be reconciled afterwards, and some tools resolve that by discarding the local side.
Payment that does not route through a phone: Card payments frequently complete through an app push or an SMS code to a home number, both of which fail when the mobile network fails or when roaming does not deliver the message. A card that authorises without a second factor, together with local cash, covers that, at the cost of carrying a bearer instrument and of using a card with weaker fraud recourse. In a wide shutdown the local card rails and mobile money usually stop as well, which leaves cash as the part still working.
Circumvention capability staged before it is needed: OONI's measurements record provider websites and app store listings blocked alongside the services they would circumvent, so a tunnel configured and tested in advance is the kind most likely to work. The cost is legal rather than technical: some jurisdictions license or prohibit VPN use, which is what the encryption and VPN legality dimension measures, and an unapproved client found on a device is itself the finding. No configuration helps during a full shutdown at the access network, because there is no transit for a tunnel to run over.

What does not help

A VPN bought or installed after the block is in place does nothing for you. The download, the payment and the account activation all cross the network that is already filtered, and the provider's domain is usually on the same blocklist as the service you wanted; where connectivity has been withdrawn entirely, no application-layer tool has anything to run over. Treating cloud sync as the backup fails for the same reason: a copy that exists only in an account you cannot reach is unavailable at precisely the moment it is needed. Direct-to-device satellite is the newest candidate and the most conditional: T-Mobile's T-Satellite service, running over Starlink, opened to commercial messaging in July 2025 and to data for a small set of applications in October 2025, but eligibility follows the home carrier's plan rather than the handset, so a visitor on a local SIM or an unsupported home operator has no entitlement to it. Apple's Emergency SOS via satellite works on iPhone 14 and later in supported countries without a carrier arrangement, and it reaches emergency services rather than the tools a trip depends on.