Notices where this attachment appears
-
https://cpj.org/2016/12/cpj-safety-advisory-crossing-the-us-border.php
I think this is bad advice. It's probably better to upload any data you really need to a server as an encrypted file then download it upon reaching the destination, and taking a pretty blank phone. Journalist organisations could even prepare android images suitable for border crossings. It would be a hassle, but better than having sources exposed.
Saying "I don't know what the password is" probably isn't going to be considered a valid response.