Travel OPSEC for Cleared AI Engineers

Before you travel

File foreign travel pre-notification.

For any foreign travel, file the pre-notification your program requires. Most cleared programs require it for any country. Some require it for any travel outside your home state. Know your rules. File on time. Late is bad. Missing is worse.

Decide what device to bring.

Do not bring your work laptop on personal travel. If you must travel for work, use a loaner travel device that has nothing on it but what you need. No cached model weights. No customer code. No vendor contact lists. No SSH keys to production. No browser history that names a program.

For international travel, assume the device will be inspected, imaged, or compromised at the border. Plan accordingly. Wipe it before, wipe it after.

Strip your phone.

The AI engineer phone is a problem. Email previews show customer names. Slack notifications show channel names. Calendar entries show meeting topics. Strip it.

• Sign out of work email on the device. Use webmail with MFA for anything urgent.
• Sign out of Slack and Teams. Sign back in if you actually need it.
• Remove or hide the work calendar. Or use a separate work-only device.
• Turn off notifications that show content on the lock screen.
• Disable AI assistants that read your screen or your messages.

Decide what you will say.

Write the cover story for what you do. Two sentences. "I work on data systems for a defense contractor in the United States." That is the whole thing. Do not name programs, customers, vendors, or specific technologies.

If someone asks more, the answer is "I cannot get into specifics." Repeat as needed. You do not owe a stranger any more than that.

Brief your travel companion.

If you travel with a spouse or partner, brief them. They get the same questions. They should give the same answer. "He works on data systems for a defense contractor." Same two sentences. Same not-getting-into-specifics.

During travel

Assume public Wi-Fi is hostile.

Hotel Wi-Fi, conference Wi-Fi, and coffee-shop Wi-Fi are not for cleared work. Use a personal hotspot or a company-issued mobile data device. If you must use public Wi-Fi, use a VPN and assume the network operator can see the metadata.

Do not paste into public AI tools while traveling.

The paste rules from the cleared decision tree still apply. They apply harder when you are tired, jet-lagged, and trying to ship something before a meeting. Most cleared incidents during travel happen in airport lounges. Do not paste from an airport lounge.

Be careful at conferences.

The AI conference circuit attracts foreign collectors. They are pleasant. They speak good English. They ask questions that sound like normal vendor curiosity. They are not normal vendor curiosity.

Flags to notice:

• Questions about specific customers, programs, or systems by name.
• Questions about who else in your company works on what.
• Offers to introduce you to interesting research collaborations abroad.
• Offers to fly you out to give a talk at a university or institute.
• Persistent contact attempts on LinkedIn or messaging apps after a brief in-person meeting.
• Anyone who already seems to know what you work on without you telling them.

None of these are automatic incidents. All of them are worth noticing and reporting to your security officer after the trip.

Watch what you put on the hotel desk.

Notes, badges, business cards, printed agendas. Hotel rooms are not secure. Lock anything sensitive in your bag, not the safe. Better: do not bring it.

Photos and social posts.

Do not post real-time photos that show your location, badge, or session topic. Post after you are home, or do not post at all. Geotagging from a foreign conference is a free intelligence feed.

After travel

Wipe the travel device.

If you traveled internationally, wipe the device. Re-image it. Do not just "check it for malware." You cannot reliably check a device that crossed a foreign border.

Report.

Report the travel as required by your program. If anything unusual happened (a contact pattern that felt off, a device taken out of your sight at customs, a person who knew more about your work than they should), report it within 24 hours. Self-reporting in good faith is fine. Sitting on something is what creates problems.

Review your bills.

Unexpected charges, unfamiliar accounts, or messages about logins from foreign IPs in the days after travel are worth flagging to your security officer. Credential theft at the border is real.

Reset what needs resetting.

If you used any work credentials during travel, even on a clean device, rotate them when you get home. Passwords, MFA tokens, SSH keys. The cost of rotation is low. The cost of not rotating, if something was captured, is high.

Stricter for international travel

For international travel, every rule above gets stricter.

• Higher-risk countries have published lists. Know which ones apply to you. Travel to those countries triggers additional reporting and, often, additional restrictions on what you can bring and what you must do after.
• Some programs prohibit certain travel entirely. Read your indoctrination paperwork or ask your security officer before you book.
• Personal travel to a country your program treats as high-risk still requires reporting. Vacation is not an exception.
• Family travel to a country your program treats as high-risk may also require reporting depending on the program.

When in doubt, ask your security officer before you book. Not after.