Travel security checklist for small teams: the laptop that goes through airports

The week a laptop leaves the office, it changes threat model twice. At the conference it sits on a WiFi network shared with five hundred strangers and one of them is having a bad week; in the hotel room it sits in a drawer while the owner eats dinner downstairs. Nothing about travel security is expensive — it is mostly decisions made at home, the evening before the flight, when there is still time to act on them. Decisions made in the departure lounge are rushed, and decisions made after the loss are grief. This checklist is the evening-before pass.

1. The pre-trip device pass: strip what you cannot afford to lose

• Ask the one-question test for every file on the machine: if this laptop is seized, stolen or imaged at a border, what does it cost us? Production API keys in .env, a browser logged into the admin panel, an SSH agent holding unlocked keys, the customer export you downloaded "just to work on the plane" — each of these turns a two-thousand-dollar hardware loss into an incident. The fix is boring: move secrets to the manager they already live in per the secrets rotation checklist, sign out of admin panels, and flush the SSH agent before you leave.
• Travel with the boring laptop, not the important one. If the team has a spare or an older machine, wipe it, update it, put the manager and the editor on it, and travel on that. If it does not come home, the post-trip work is a supermarket purchase, not a lost-laptop runbook at 2am.
• Full-disk encryption on, verified, not assumed. FileVault or BitLocker takes minutes and means a stolen powered-off laptop is a paperweight. Verify it is actually enabled — "I think I turned that on" is not a control; the toggle screen is.

2. Sort out the second factor before there is no office to text

• Take the second factor with you — deliberately. An authenticator app on the phone travels fine; the office desk phone that receives fallback SMS does not. Check each critical account's MFA method before the trip and move anything SMS-only to an app or a hardware key where the MFA rollout checklist already made room for it.
• Print the backup codes and put them in the passport wallet. A dead phone battery in another country is the classic lockout, and account-recovery-by-SMS to a number you cannot receive is the classic incident. Paper codes in the same pocket as the passport survive both.
• Decide who is on call at home, and say it out loud. The traveller who holds the only admin credentials is a single point of failure at 30,000 feet. Hand the break-glass credentials to the person who is staying home, using the same access model as the office — this is a one-line add to the on-call arrangement the escalation policy already defines.

3. The road data rule: bring nothing you cannot re-download

• Cloud fetch, not local copies. Anything you need on the road should be reachable through an account you can log into, not sitting in a folder on the laptop. The customer list you might need is one sign-in away; the customer list you copied to the desktop is one theft away. This is the same "data lives in one place" discipline as the remote work checklist, just with worse coffee.
• Do the plane work on throwaway material. Slide decks, drafts, reading lists — fine. Exports, databases, credential spreadsheets — those stay home and get pulled over a tethered connection when actually needed.
• Assume the device will be inspected, not just lost. Border and customs searches are legal in many jurisdictions and are not a "how likely" question for the devices that cross borders monthly. If a machine or a phone regularly travels internationally, it should hold nothing whose disclosure would be an incident — that rule costs nothing to follow and everything to break.

4. Hotel and conference WiFi: assume hostile, act accordingly

• Prefer the phone hotspot to the venue network, always. A personal hotspot on cellular is one tap and puts you on a network of exactly one device. The conference WiFi that requires the room number and surname is a shared network with unknown neighbours and a captive portal you cannot audit. Hotspot first; venue WiFi only when the hotspot cannot carry the load.
• On the VPN every session, before the first login. The always-on discipline from the remote work checklist matters more in a hotel than at home, because the coffee-shop threat model is the hotel's too. The rule is not "VPN for sensitive things"; it is "VPN up before the browser opens", because sensitive things do not announce themselves.
• No admin panels on venue networks, full stop. Shipping a production config change over conference WiFi is a choice that can wait four hours. If it genuinely cannot wait, it goes over the hotspot, through the VPN, by the person whose turn it is — and the emergency that "cannot wait" gets logged like any other exception.
• Watch the captive portal for the bait. Venue portals are where evil-twin APs live: the network named "Hotel_Guest_Free" one signal-bar stronger than the real one. The defense is boring: ask the front desk the exact SSID once, save it, and refuse the prompt to trust new certificates. A portal that asks you to install anything is not a portal.

5. Physical: transit, the hotel room, and the conference floor

• The device never leaves your sight in transit, and never sleeps in a car. Overhead bins, taxi boots and "I'll just leave it while I grab coffee" are the top three disappearance venues. On the plane it goes under the seat in front of you, not the overhead — the same crown-jewel logic as the office physical checklist: the things that cannot be re-issued travel on your body or in front of your knees.
• In the hotel room, the laptop goes in the safe or it stays out of sight and locked down. A room safe beats a drawer; if there is no safe, the laptop sleeps closed, locked, out of sight, with the screen lock on a short timer. The hallway housekeeping staff are not a threat model you get to choose — they are a fact, like weather.
• The conference floor is a phishing venue with lanyards. Badge scanners, "sponsors" running lunchtime prize draws, and USB sticks in the swag bag are all collection devices. A USB stick from a vendor booth gets plugged into nothing you care about; the free charging kiosk is a cable you did not buy; the QR code on the poster goes where the poster says, not where the poster's printer was told. When in doubt, the same reflexes as the phishing checklist apply, just outdoors.

6. The re-entry check: the trip is not over when you land

• Review sign-in activity for the accounts you touched on the road. Ten minutes in the admin panels on the day of return: new sessions, new devices, impossible locations. The point is not paranoia; it is closing the loop while the trip is still recent enough to interpret.
• Rotate anything that lived on the travel device. If the travel laptop held session tokens, API keys or saved logins, rotate them on return per the API key rotation checklist. "It came home, so nothing happened" is an assumption; the rotation converts it into a fact.
• Run the ordinary update-and-scan pass once, then unpack. The travel machine re-joins the office network after it has patched — not before. Airports and hotels are where machines meet networks you would never connect to at home; the first act back on trusted WiFi is updates, not file sharing.

7. The ten-minute quarterly rehearsal

• Rehearse the evening-before pass before there is a flight. Once a quarter, whoever travels next walks the checklist against their actual laptop: what is in .env, what is signed in, what is on the desktop, is encryption verified, where are the backup codes. The first time you do this should not be the night before a client visit.
• Do the walkthrough of the lost-laptop drill while you are at it. Who gets called, what gets wiped, what gets rotated, in what order — the runbook on paper is worth nothing until one person has read it with their own machine in their hands.
• Write the three-line travel pass into the quarterly folder. Device stripped yes/no, MFA checked yes/no, re-entry done yes/no — it slots next to the WiFi walk test and the DNS filter re-check in the same quarterly folder, so the whole "people moving around" layer gets reviewed in one sitting.

Travel security for a small team is one calm evening before the flight: strip the travel laptop of anything you could not afford to explain losing, put the second factor and its paper backup codes in the passport wallet, bring data you can re-download instead of copies you can lose, hotspot over venue WiFi with the VPN up before the browser opens, keep the device on your body in transit and locked down in the room, review sign-ins and rotate keys on the day you land, and rehearse the whole pass once a quarter. The Ops Starter Kit ($14) turns the pre-trip and re-entry passes into fill-in-the-blank sheets, and the Automation Starter Pack ($19) schedules the quarterly rehearsal so it happens before the booking, not after the loss.