We explain how donations can be found when crossing the border and how to protect yourself

Donations or attempted donations from Belarusian cards

There are known cases where people were detained for donating or attempting to donate directly from Belarusian cards. This is the easiest way for law enforcement to track.

Banking apps and crypto wallets

Belarusian law enforcement uses the Russian program "Mobile Forensic Expert". It allows automatic scanning and analysis of banking applications — even those of foreign banks.

The program extracts the entire payment history from the bank's databases: exact time, amount, currency, recipient's account/card number, and also the purpose of the payment (comment). These fields can reveal words like "donation", "help", "charity", "collection" or names of foundations and initiatives.

And even if the banking application itself has been deleted from the phone, hidden, or additionally password-protected, the system's notification databases (Notification Center on iOS or Notification Listener on Android) often store the texts of all push notifications about successful fund debits, indicating the amount and service/recipient.

The Russian development can also search for deleted lines in the databases (.wal, .journal) of banking applications. This means that even if data was deleted (for example, you destroyed the card or donated from a one-time card), there is a possibility that it will be restored.

"Mobile Forensic Expert" can also analyze accounts on crypto exchanges and in mobile crypto wallets. The scheme is exactly the same as with banking applications.

And if the history on the phone itself was cleared, but authorization tokens or passwords were saved, the tool can connect directly to the servers or web versions of some services and crypto exchanges (for example, Binance) and download the complete transaction history.

A ready list of bank accounts, card numbers, or crypto addresses (for example, official details of support funds, crowdfunding campaigns, or organizations) can be loaded into the program. The program will automatically scan all financial applications on the device and mark matches.

This suggests that law enforcement uses this capability, among other things, to search for donations from foreign cards for people living abroad. Extracting information takes minutes.

Usually, people are not detained immediately for crypto donations — it takes additional time to match a crypto wallet with an organization, and there are many collections, making it unrealistic to put them all on a stop list. But it is ultimately possible to match them, as the wallets of those collecting funds usually do not change.

But there is another way. There is a known case when a major exchange, Binance, handed over information about donations from six Russian citizens in support of Ukraine to law enforcement. As a result, Russian citizen Yuri Belenky, who had lived permanently in Bulgaria since 2015, was sentenced to a long term.

The file that Binance provided to the Russian Investigative Committee contained a detailed account history from the moment of registration — including his complete transaction history. He himself knew nothing about this.

Conversations with others

In one of the cases known to us, the person's phone was completely clean.

But a conversation about a donation was found on a computer where Telegram was installed.

Perhaps "Mobile Forensic Expert" also helped law enforcement in this case. It can scan conversations for keywords, find donations through screenshots, recognize voices, and search for account numbers and crypto wallets in correspondence.

If a dialogue or individual messages about donations were deleted, the program tries to extract them from unallocated memory and SQLite databases until they are overwritten by other information.

Emails

If you donate, a message about a successful donation or a thank-you letter usually comes to the email address you linked to the payment. Law enforcement has methods to analyze such information — such a message can certainly become evidence in court.

How to protect yourself?

"You should cross the border with a feature phone. You can take photos with loved ones on their phones, and they will send you the pictures later. You can do without an advanced phone for a couple of weeks. Is it worth the risk?

Or with an old smartphone that has a dozen necessary numbers and no messengers," suggests an interlocutor who suffered for donations.

Representatives of the "Cyberbeaver" initiative say that it is impossible to fully protect yourself from persecution for donations simply by wiping your phone or choosing the "right" device.

"In the case of donations, the device itself is not always the main risk. Data can usually be cleaned from a phone — and even should be — but deleting information about donations is not always that simple. And if payment data is with a Belarusian bank, there is little you can do.

When it comes to donations, the first questions to ask yourself before a trip are not about the phone model. What card did you use for donations and in what way? Were any payments made from a Belarusian card? Could the charitable organization to which you transferred money have been a victim of a data leak?

During a border inspection, the main threat may not lie in law enforcement having special software, but in the ordinary human factor — if you are asked to unlock your phone and find and show the necessary information, no one can guarantee who will do what with it in a specific situation."

Representatives of "Cyberbeaver" say that it is most difficult to obtain data from modern devices with up-to-date security updates. These are the latest iPhone models on fresh iOS and Google Pixel. Older models that no longer receive updates and budget Android smartphones are more vulnerable. But it is impossible to guarantee that a specific model cannot be hacked.

"Neither Cellebrite nor "Mobile Forensic Expert" can retrieve deleted data if the deletion was done in advance, and not an hour before the check. Therefore, we recommend thoroughly cleaning your devices in advance or taking "clean" ones for crossing the border," say "Cyberbeaver" representatives.

Here is the checklist they offer:

• banking applications and messages — transaction history, SMS and push notifications about debits, emails with receipts, screenshots of transfers in the gallery;

• crypto wallets, if donations were made through them — applications, seed phrases in notes or photos;

• subscriptions and correspondence — fund channels, chats with volunteers, thank-you messages for donations and letters from initiatives.

• 14
• 1
• 3
• 0
• 1
• 0
• 7
• 0