US citizen charged after GrapheneOS phone wipes during airport search

Join the discussion

• Hacker News
• One of the GrapheneOS people (I think) suggested keeping a bit of paper in your wallet with the duress pin, perhaps thinly disguised. Then the cops could try it on their own initiative. I suppose they'd become aware of that trick eventually, but then they wouldn't be able to use all those other genuine pins they find.
  by incompatible
• A far better approach is for the US citizen to simply say "I chose not to provide my PIN".

  The officer will say something like "That's your choice, but I will need to seize the device to conduct an analysis. It will be returned once the analysis is complete".

  Then you shrug, and they will let you enter the US. The cops will try to get into the phone, fail, and return it to you.

  Just bring a phone you don't mind losing for a few months.

  by refurb
• This is an interesting idea, but was that GrapheneOS person a lawyer giving legal advice?
  by Verdex
• > US citizen charged after GrapheneOS phone wipes during airport search

  > It's concerning – and sends the message that [GrapheneOS] is criminal by default

  What's with this sensationalism? The GrapheneOS phone didn't just wipe itself - the defendant actively took steps to wipe it. The defendant isn't being prosecuted "by default" for having a GrapheneOS phone. He is being prosecuted for what he actively chose to do with that phone.

  If your argument is that the search and seizure was unconstitutional, and you're within your rights to wipe your data, then argue that. I'm very sympathetic to such arguments. But stop with this "they prosecuted me for having a GrapheneOS phone" misdirect

  by whack
• Doesn't matter, increasingly law enforcement is treating nicher secure OSs as a sign of illegal activity.
  by epolanski
• If this happened in an EU country you'd all be wetting yourselves, but for some reason the rooms different today. The professional advice we are given traveling to the US is back up you phone, wipe it, travel and restore once you are comfortable. Sad state of affairs guys
  by northernsausage
• In the US, he could have refused to give the pin and that's protected under the 5th Amendment. They would have nothing because they couldn't get into the encrypted phone.

  In many countries other then the US like Ireland, they have key disclosure laws which require you to testify against yourself.

  In the UK, police can even require key disclosure without a judge.

  by Cider9986
• Another commenter posted the complaint: https://www.documentcloud.org/documents/28513012-samuel-tuni...

  The terrifying line of this for me is: "before and during the search", namely the "before" part. Even if you wiped your device days before, they could always make the argument that you destroyed evidence back then because you were trying to prevent them from searching your device.

  INAL so not sure if this would hold up in court.

  by _fat_santa
• How are they going to prove there was evidence of a crime? While destruction of potential evidence does introduce a certain amount of leeway that doesn't allow going from absolutely nothing to "evidence was on the wiped device".

  Most previous court cases involving encrypted devices have required substantial proof that the encrypted device contained incriminating evidence. To be clear "you sent this illegal thing from your house" levels of evidence.

  It mostly seems inept, if you are going to push to expand your powers you do it on strong cases where you know what happened. Doing it on weak cases like this gives a judge an opportunity to shut down that without giving you a chance of a meaningful conviction and without that you won't get any benefits...

  by Guvante
• The career prosecutors at the DoJ are not the same as a couple years ago. I hope this case ends the same way as the sub sandwich assault.
  by dannyw
• I'm not a lawyer, but my work domain revolves around data analysis of certain types of crime. Often times the suspects are flagged and under surveillance, so if and when they cross borders or go through check-points where you have a great deal of authority, they'll get searched.

  In many countries certain agencies / agents can do searches which normal law enforcement officers can't. Like not needing a search warrant or even probable cause. Not to mention that wiping a device could in itself be a crime, if it is suspected that evidence is being destroyed.

  The key point here is that, as I wrote, some agencies have a lot of authority, and have the power to do pretty drastic stuff.

  by TrackerFF
• >How are they going to prove there was evidence of a crime?

  They don't have to, only that you destroyed evidence. That's why many people get prosecuted with "obstruction of justice" rather than the actual crime.

  >While destruction of potential evidence does introduce a certain amount of leeway that doesn't allow going from absolutely nothing to "evidence was on the wiped device".

  So if someone was doing insider trading, and the SEC came knocking, then immediately afterwards they start burning every document they have and microwaving their computers, do you think they should get off the hook? Surely you must think, even if the authorities or society can't a priori know you were guilty, the subsequent activity should be illegal? Note this isn't the same as banning burning documents or microwaving computers, only doing so after you're aware there's an ongoing investigation.

  by gruez
• For non-graphene users (eg. Boring iPhone people like me).

  So there’s a feature called Duress PIN which as explained through some comments means you put a different pin which intentionally wipes the phone. It’s not auto wipe or wipe after several failed attempts but intentional wipe of device. (Worth explanation as the current title nor the article doesn't easily explain this was made by the US citizen providing the alternative passcode)

  For more technical details:

  > GrapheneOS provides users with the ability to set a duress PIN/Password that will irreversibly wipe the device (along with any installed eSIMs) once entered anywhere where the device credentials are requested (on the lockscreen, along with any such prompt in the OS).

  https://grapheneos.org/features#duress

  by rock_artist
• Sounds like a feature that under right circumstances can land you in Guantanamo for 5 years where eventually you get cleared once the real terrorist gets caught.
  by mrtksn
• It zeroes out the vault where the volume key is stored.
  by il-b
• That's a nice feature, every OS should have that.

  I believe the old TrueCrypt had two passwords, each revealing a different set of files. You'd put e.g. your tax forms in one, so if forced to decrypt your drive, you could cooperate and do so.

  It's not illegal to delete your own vacation photos. So to prove this guy guilty of destruction of evidence, does the government need to prove there was actual evidence in the phone?

  by zugi
• PIN to wipe seems suspicious. How about a PIN where it login to a patriotic profile and phone looks like normal android.
  by f-serif
• > federal agents had already circulated his name and photo internally, saying he was under investigation for "suspected terrorism activities" because of his alleged association with the movement against Cop City

  Of course it’s about that huh. It’s quite scary how far the US will go against anyone who engages in this sort of activism.

  by daishi55
• An earlier story alluded to csam

  Wonder if it’s just a fishing expedition

  by Havoc
• This is the most troubling part of the whole episode. Targeted by the government. Its been a long rough slope to get here but they are at the goal line.
  by wilburx3
• Here is the indictment: https://www.documentcloud.org/documents/28513012-samuel-tuni...

  Here is the statute Tunick is indicted under: https://www.law.cornell.edu/uscode/text/18/2232

  There is an immediate problem: the device was being searched, and this statute criminalizes destruction of property to prevent seizure, not searches. I don't think this statute applies this situation. Regardless of whether the border agents could lawfully search his phone at the border, they didn't have grounds to seize it. I suspect this prosecution will quietly be dismissed within a few months.

  by whats_a_quasar
• CBP are empowered to seize devices if the owner refuses a search.
  by ytoawwhra92
• OR the US administration could drag out the case hope it gets to the Supreme Court for another roll of the dice on weakening the Bill of Rights.

  As usual, government should have obtained a warrant if they wanted to search a US citizen.

  by axus
• If your threat model means you can’t afford for border security to view your device, wipe the damn thing yourself before crossing the border and restore it from an encrypted online backup on the other side.

  You’re just carrying a blank phone that you intend to set up and use later, and they can’t force you to install your backup onto a phone.

  Now, this is sus as hell, and you’ll probably draw all kinds of extra attention, but if border security wants access to your phone in the first place, you’re already in a weird place.

  by DanHulton
• The french cybersecurity agency (ANSSI) used to share leaflets to tell you to do just that. The US government wasn't named, but it's part of the ones that like to do some economic intelligence and no euro who read the news would trust it more than a banana republic when it comes to crossing the border.

  Now having a corporate device with little data is no longer outstanding. Everything is in the cloud these days.

  As for personal devices, you can explain you're taking a dumb cheap laptop for your holiday as you're working on a desktop PC at home. You're not taking your entire house when you're on a trip, just a laptop to check tourism information and post blog posts

  I myself bought a crap laptop on ebay to shove it in bags and backpacks and go to conferences and not be sad the day it's broken.

  but above all, he's a citizen so shouldn't care about looking "suspect". He has a right, not a privilege, to cross that border. They can explain a judge how he looked sus if they really want to search his home.

  by hinata08
• > You’re just carrying a blank phone that you intend to set up and use later, and they can’t force you to install your backup onto a phone.

  They can just make this illegal too, and ask for the keys to your backup, or detain you until you do. Point is, you can't gain freedom through technology. It was always a political thing.

  by thrance
• What is sus as hell is the US government. It is incredible how people here are accepting things that was outrageous a few years back.
  by wesleywt
• Pff one time when travelling to the US I brought two laptops, macbook and a thinkpad. I just reinstalled the thinkpad and somehow the border patrol was very interested in it. Asked me to ‘show my gallery’… it was a guiless setup and only had a terminal, problem was… somehow my keyboard layout or something was messed up and i could not even login… i spend around 2 hours being questioned by 6 people…they didnt even take a look at the macbook
  by thenthenthen
• Those who thought that a duress pin was a good idea for border crossing are probably going to choose this alternative.

  It doesn't have to be blank - just clean.

  by intrasight
• this isn't even that weird, when I worked in a BigTech it was pretty explicit that there were certain countries where you should not bring your actual work device through the border, and you'll get set up with a different one while in that country.
  by bobthepanda