Remember important phone numbers:
The employee must fill in some of the numbers themselves, as these will vary in individual cases.
UiA Emergency Preparedness: +47 381 42 220, or email: beredskap@uia.no Sjømannskirken’s (Norwegian Church Abroad) emergency telephone: +47 951 19 181
Ministry of Foreign Affairs: MFA emergency line: + 47 239 50 000, or email: 247@mfa.no
Insurance company:
Nearest embassy:
If you have any questions, contact:
- jan.e.heinecke@uia.no
- Phone
- +47 38 14 11 38
1. Introduction
When you are travelling, someone may attempt to gain access to information from you without you necessarily noticing. To reduce the risk of this, it is important to follow the travel advice in these guidelines. We divide travels into three different risk levels:
- Travel to countries within the EU/EEA/NATO area.
- Travel to countries outside of this area (they are defined as risk-prone areas, and you must take extra precautions)
- Travel to high-risk countries. These are countries that the Ministry of Foreign Affairs advises against travelling to (see section 5. Special requirements for travel to high-risk countries).
In addition, some countries have an elevated state intelligence risk, which means that we regard them as high-risk countries and that we must follow the guidelines found in chapter 5. This currently applies to China, Russia, Ukraine, North Korea and Iran. Norwegian security authorities such as NSM and PST update these threat levels.
Chapters 2-4 of these guidelines deal with travel to risk-prone areas and also provide general information for travel to countries below risk level 1. Chapter 5 concerns travel to high-risk countries. These guidelines have been created for employees at UiA, but the routines found here can also be useful for students.
2. Before travel
- Contact UiA Help well beforehand if you need guidance concerning the points below: 38141000 / hjelp@uia.no
- If the journey involves a visit to or via a high-risk country, or a country with a high level of intelligence activity - skip directly to section 5 of the guidelines.
- Travels must be ordered through Berg-Hansen, according to UiA’s travel policy.
- If the journey involves a visit to or via a risk-prone area, discuss the security threat with your manager and contact the security manager and/or information security manager if you want input on suitable measures. Here, elements such as what information you have access to, what authority and role you have, which actors may be interested in you, your knowledge and authority, and what needs you have for communication and access to information on the journey must be assessed.
- Think through the need to bring information and diverse storage devices out of Norway and minimise the amount as much as possible. Data needs to be protected according to Guidelines for classification, and be correctly stored based on the information’s potential for damage.
- Portable machines must be encrypted. UiA's PCs have encrypted disks. If you have a Mac, you must make sure that encryption is switched on (settings, switch on "file vault", and keep the key in a safe place).
- Check that all security updates have been carried out and installed before departure:
- Open "Settings", select "Update and security". Make sure that "Windows Update" has installed the latest update, and that all the points under "Windows Security" are green.
- Make sure your phone and tablet are secured with a password. If you have older devices, check in settings that encryption is turned on.
- Remember to use unique and strong passwords, as well as two-step verification where possible, also on your private accounts, email and social media. You must never approve a two-step request without having a login in front of you.
- Make sure to install Outlook with the UiA account on mobile devices, this gives you the opportunity to delete content on the device via the IT department's security tool if the device is lost. Be sure to contact UiA Help as soon as possible if the device is lost.
- USB devices for storage (disks, memory sticks, etc.) should not be brought on the trip. If there is a special need, they must be set up with BitLocker. If you are offered to use a USB storage device such as a memory stick from someone, say no. Also avoid lending your own memory sticks or other USB devices with memory. In general, one must be very careful with all foreign devices that use a USB connection. This also applies to pointing devices and mice.
- Leave your UiA ID card and keys at home.
- Make sure you have valid travel insurance and that the contact information for the insurance company is easily available.
Register in the Ministry of Foreign Affairs' travel register in order to obtain any necessary crisis information: https://www.reiseregistrering.no/
3. During travel
- Switch off WiFi and Bluetooth on all devices when not in use, this should be turned off as much as possible during the entire journey.
- Disable automatic connection to wireless networks (WiFi).
- Avoid using wireless WiFi networks if possible – use mobile data instead (be aware that costs may apply)
- If you must use WiFi, it is recommended to connect with UiA's VPN, see instructions at eduVPN.
This will prevent others from reading your internet traffic. - Avoid installing updates during your stay. Be careful when visiting new websites and receiving links in e-mails and SMS. Always check whether the link address is legitimate and ensure that there is a padlock in the top left corner of the browser and HTTPS before you enter your username and password. Pay attention to any security warnings or error messages, and familiarise yourself with best practice use of the internet. Nettvett.no – Hvordan vurdere om et nettsted er sikkert (in Norwegian)
- Please note that hotel rooms, conference rooms, mobile phones etc. may be compromised.
- Avoid leaving devices (mobile phone, tablet and laptop) in places where you do not have them under direct supervision. This also applies to hotel rooms and the hotel safe. When you leave the hotel room, all information devices should come with you. (This applies to journeys to risk-prone countries – to high-risk countries such equipment is not brought.) If this is not appropriate or possible, equipment left in hotel rooms or similar places must be switched off, not in standby, power saving mode or similar.
- Never give away your usernames and passwords.
- Preferably use your own charger for mobile phones and other devices. Buy a new one rather than borrow someone else's.
- People often sit close together on planes or trains. If you are going to use your laptop or tablet for something on the go, you should think about what it would mean if someone were to see what you have on your screen, or what you are writing, and adapt your activity accordingly.
- Report changes to your itinerary to UiA's travel agency, if the change has not already been made in the travel portal.
4. After returning home
- Be critical of unexpected and unknown security alerts. Contact IT security personnel via UiA Help.
- Do not assume that you and your devices are safe only a few days after returning home. The consequences of having been compromised can come over time. Pay particular attention to e-mails with attachments that arrive later.
5. Special requirements when travelling to high-risk countries
UiA devices must not be taken on trips to high-risk countries. If there is a need to use a mobile phone on such private trips, it can be borrowed from the IT department, and must be returned after use.
Business trips to countries advised against by the Ministry of Foreign Affairs (MOF) must not be carried out unless strictly necessary. The exceptions must be approved by the HMS manager after a risk assessment has been carried out in collaboration with the Emergency Preparedness Officer at UiA. Use your own template created for the purpose. You can find the template here.
The risk assessment will form the basis for whether the journey can be carried out.
UiA can choose to introduce approval requirements for business trips to certain areas that are not on the Ministry of Foreign Affairs' list. In such cases, the same rules as above apply.
When travelling to countries exposed to risk, the individual is responsible for registering their journey with the Ministry of Foreign Affairs' travel registration before departure. The employee is responsible for familiarising himself with the security situation in the relevant countries, and making the necessary preparations with regard to insurance, vaccination and travel documents.
The risk assessment in advance of the journey will be the basis for further assessments regarding the use of information and communication technology on the journey. As a general rule, your usual IT equipment (laptop, mobile phone, tablet and so on) should be left at home on high-risk trips. It is possible to borrow equipment from the IT department if necessary.
5.1. Checklist for travels to high-risk countries (this advice can also be useful when travelling to countries that are not characterised as high-risk)
Report business trips to high-risk countries to your employer well beforehand - preferably 3 months before departure. It must be reported to the immediate supervisor with a copy to beredskap@uia.no.
Contribute to the risk assessment of the journey and follow up on agreed measures.
The trip must always be booked by the travel agency UiA has an agreement with. Changes during the journey must be reported to the travel agency and to your employer.
Register your trip at www.reiseregistrering.no
During the journey: follow the points in chapter 3. Only use equipment (PC, mobile) that IT has recommended you use on the journey. Expect that telephone, SMS and data transmissions may be monitored and limit your communication accordingly.
Keep in touch with your employer regularly. Monitor changes that affect any possibilities of risk and report them.
Make sure that you have any necessary contact information available. See Attachments.
Download the Sjømannskirken - Norwegian Church Abroad app - emergency numbers and other contacts.
Download the Ministry of Foreign Affairs' "reiseklar" and familiarise yourself with how it works.
On return: Report to your nearest manager and send a copy to beredskap@uia.no. Contact your IT contact to complete planned measures and to return any devices on loan.
5.2. General precautions concerning personal safety
Prepare for the visit by familiarising yourself with the situation in the country you will be visiting (political conditions, culture, religion, crime, terrorism, etc.).
Avoid creating distrust.
Demonstrate respect for the culture, religion and traditions in the country you are visiting.
Avoid discussions concerning politics and religion.
6. UiA’s routine for travels to high-risk countries
High-risk countries are mainly defined by the Ministry of Foreign Affairs’ travel guidelines: utenriksdepartementets reiseråd. UiA can also introduce travel restrictions to certain areas. These decisions will be published in the travel portal on the intranett. If you cannot avoid travelling to a country advised against by the Ministry of Foreign Affairs, a risk assessment must be carried out well in advance of the trip.
6.1 The traveller’s duties and responsibilities:
- Find out whether the planned trip involves an area that the Ministry of Foreign Affairs advises against travelling to.
- Make your own assessment of the necessity of travel – consider whether the journey can be postponed or avoided.
- Notify the director in your own unit of the necessity and need for assistance with risk assessment.
- Participate in risk assessment.
- Follow up the measures which are decided upon in the risk assessment process.
- Follow the established routines for travel.
- Any devices that were borrowed must be returned to the IT department. These must not be connected to UiA's network.
6.2 HMS manager (Head of Faculty, Administrative Director)
- Personally assess the necessity of the trip - consider whether the journey can be postponed or avoided.
- Invite the traveller, security manager and information security manager (or others with delegated responsibilities) to a meeting to carry out a risk analysis of the nature of the trip, the traveller's needs, as well as personnel and information security risks associated with the trip.
- Stay in contact with the traveller during their journey.
6.3 Security manager
- Contribute to risk analysis if needed.
- Follow up any inquiries coming via email.
- Consider the need for different measures.
- Extraction of data from devices is done in consultation with UiA's IT security personnel and checked for malicious software. USB devices brought home from high-risk countries must be destroyed.