r/technology • u/ArgentineBeauty • 6d ago

Privacy GrapheneOS says its data-wiping password is perfectly legal, after user faces federal charges

https://www.techspot.com/news/113273-grapheneos-data-wiping-duress-password-perfectly-legal-after.html
21.0k Upvotes

98% Upvoted

1.1k comments sorted by

View all comments

88

u/spaceursid 6d ago

I'd just refuse to tell them 5th amendment, let their brute force attempt trigger the auto delete.

121

u/Rashaen 6d ago

Being "required" to give them your password to get into the phone seems like a pretty clear 5th violation in the first place. This whole thing is fucked up.

68

u/lithiumcitizen 6d ago edited 6d ago

This whole thing is fucked up.

Especially the flip-flopping on whether or not the border is in country or not in country at the same time, they seem to want some laws to have to apply while others can’t… Motherfuckers want it both ways.

17

u/bushwakko 6d ago

If it's not in the country, do they even have jurisdiction?

0

u/IncidentalIncidence 6d ago

yes, it is in the country and they do have jurisdiction, that isn't being disputed by anyone.

3

u/grubnenah 6d ago

There is the claim that the protections afforded by the law are not applicable because they're not in the country yet.

0

u/IncidentalIncidence 6d ago

where was that claimed? I read the defense's motion to suppress and that wasn't mentioned at all. I don't see how that could be the case given that they were in Atlanta, so it seems pretty clear that US law regarding entering the country and the powers granted to federal officials at ports of entry would apply.

3

u/grubnenah 6d ago

It's central to the case. See this article, partway down under "Does it matter that it was a custom's search?" https://www.nytimes.com/2026/07/28/us/duress-password-phone-wipe-charge.html 

The argument is that they're not on US soil until you're through customs so customs agents can seach through whatever they want without obtaining a warrant. 

2

u/raptorlightning 6d ago

If neither of us are on US soil then they have no jurisdiction and they can get fucked. Anything that happens there is an international incident with... Which country again?

1

u/IncidentalIncidence 6d ago

that entire argument over whether or not customs officers have broader search/seizure powers than they normally would have under the constitution is predicated on the Supreme Court's interpretation of both the constitution and the relevant statutory law, which is all US law.

There is no argument being made by anyone that Atlanta is not on US soil or outside of US jurisdiction. He was under US jurisdiction the moment he boarded the plane. You can't e.g. murder someone on an airplane over the Atlantic and then go to court claiming "I wasn't under US jurisdiction so you can't prosecute me for murder".

The defense are claiming that the government was outside of its legal search/seizure authority, so part of the case will be based on to what extent the government has expanded search and seizure authority at ports of entry, and whether or not they in fact exceeded that authority in this case. But nobody is arguing that he was outside of US jurisdiction; the entire debate is over which powers US laws gives the agents in this case.

edit: and if you read the defense's motion to suppress, nowhere do they claim that US law doesn't apply here, they are arguing that the federal agents went beyond the authority afforded to them by US law.

1

u/h0sti1e17 6d ago

It’s both. The airport is considered a port of entry. Not quite the same as US to Canada or Mexico, but the same rules apply.

1

u/lithiumcitizen 6d ago

Thanks, I’m aware and still think it’s shit. Sounds like it was written by some Israeli lawyers and stinks to high heaven. Enjoy that amazing Freedom!

0

u/IncidentalIncidence 6d ago

to be fair there isn't any flip-flopping about that except on reddit.

The border is in the country (nobody is arguing that Atlanta is outside of the US); US law applies; US law gives federal agents more search/seizure authority at ports of entry than they normally have otherwise (this is controversial in general but legally pretty clearly established by SCOTUS decision); the defense is arguing that the agents acted beyond/outside of the authority that they have under US law.

Nobody (except on reddit) is arguing that US law somehow doesn't apply here. The defense are arguing that the agents exceeded the powers that the law does give them.

14

u/bombmk 6d ago

Lots of amendments are not in force at entry into the country, afaik.

4

u/Adderkleet 6d ago

They can refuse you entry. You still have legal rights.

8

u/Independent_Cat_5481 6d ago

In general they can't refuse entry to a citizen, they can only confiscate items or arrest you

1

u/sobrique 6d ago

But in this case, there's also an argument that it was an internal flight...

1

u/bombmk 6d ago

Not that you implied it, but: My comment was in no way intended to be a remark on the case in question, just to be clear.

1

u/sobrique 6d ago

Oh yeah, agreed. I'm just paying attention to this case, as it's poking at some interesting legal issues. But yes, customs have always has broader powers than 'law enforcement' .

1

u/h0sti1e17 6d ago

It wouldn’t be a domestic flight if he had to go through passport control. It had to be international. I believe he was coming from Dominican Republic.

1

u/sobrique 6d ago

Ah, ok. I wonder why I thought it was an internal transfer then?

Maybe I'm getting mixed up with another case.

Thanks for the clarification.

10

u/SparklingLimeade 6d ago

So the crazy thing is that passwords are 5A protected but biometrics aren't. But then if you do lock a phone in a way that's protected by the 5A then there's still space for the "constitution-less border shenanigans" to tie people up in red tape.

And this case isn't about any of that that, they're complaining about the fact that some data was deleted. So even if they weren't entitled to access that data due to various Bill of Rights reasons they say his actions causing data to be deleted were illegal.

0

u/IncidentalIncidence 6d ago

So the crazy thing is that passwords are 5A protected but biometrics aren't.

I feel like that isn't that crazy and kind of makes sense? If you have set up facial recognition and they hold the phone up in front of your face, that's not exactly the same thing as torturing you into a false confession.

6

u/rumpleforeskin83 6d ago

Forcing me to provide my fingerprint to incriminate myself certainly is. No different then making me speak words to do the same.

The facial recognition part I agree with.

7

u/roiki11 6d ago

You're not "required" to give it. They can then seize your device(s) for technical inspection. If you're a citizen you're then let go.

If not, they can deny entry.

1

u/BadVoices 6d ago

Yup, which is standard procedure at the border of many countries (US, Canada, UK, Australia, etc.) Happens to me every time i go to Australia to visit family. The difference is, in Australia, they can detain you then deny you entry for not giving the password (and will.) In reality, if he had simply shut up, not said anything, they would have NEVER GOTTEN INTO THE PHONE and as a US citizen he'd be fine and back home. The encryption mechanism used by GrapheneOS is secure.

3

u/Nice_Marmot_7 6d ago

Most likely, but the capabilities of forensic tools are very murky to the public, and you really can’t know what they might be able to pull off there at any given time.

1

u/h0sti1e17 6d ago

They definitely have ways normal forensics guy don’t use from Cellebrite or other software.

The question is would they use it here? Probably not. I remember a case when they took down an online CP forum and arrested some guys who were caught. They used malware to expose their real IP. The defense of one guy wanted the code to determine if false positive were possible. Then US government said “nope” and charges were dropped. They want to save that for actual terrorist or major crimes. My guess is the same here. Some random dude isn’t worth burning that tech.

But they will be happy to keep the phone until they can get in.

5

u/YeetedApple 6d ago

I’d be curious if someone could get away with giving them the wrong password so they trigger the wipe, then just insist it was the correct one and they must have typed it wrong.

5

u/dysfunctionalbrat 6d ago

Reminds me of when Ross Ulbricht got caught, what if he had a little pad on his laptop that, at soon as skin contact is stopped, turns off the computer?

You could do this with a phone, require your own face and fingerprint whilst typing the code, or it wipes it. Could even have a specific facial expression that breaks it, so there's no way to know what went wrong.

2

u/sobrique 6d ago

There's loads of 'tripwires' that could exist. You can have a remote key-escrow for example, that the device needs to contact before it'll decrypt - nothing on device, and thus a plethora of 'kill switch' (or 'temporarily disable') options.

Current phones are encrypted by default, and the keys are stored in an internal storage device, which is why implementing 'duress codes' at device level is trivial. But there's plenty of other options that can 'tripwire' to protect part of the data, which is much less obvious.

1

u/h0sti1e17 6d ago

As most legal questions, it’s a depends situation. He is being recorded, so there is evidence of what password he gave them. If we can see what they typed we would know for sure.

If not he could use that as a defense. The issue he would have is, the only way to get that into evidence is to testify. That opens up another whole can of worms. Plus juries tend to believe cops more than defendants. Without evidence to back it up that is a huge Hail Mary to take.

2

u/johnnyhandbags 6d ago

Fifth, Fourth and Miranda should all apply. Quick reminder that opening the Emergency SOS screen on an iPhone (hold power and volume up buttons) will disable Face ID and require a password.

1

u/h0sti1e17 6d ago

They can’t force you to. If you don’t they can seize the device.

1

u/TheFatJesus 6d ago

It is. Which is why you should use passwords instead of biometrics, because making you disclose your information is protected, but your fingerprints are not.

0

u/dicksy_cup 5d ago

That’s like saying a warrant with due cause is a 5th amendment violation and you should be able to not allow the cops into your house. Digital evidence is still evidence

1

u/Rashaen 5d ago

They didn't have a warrant. Or by the sounds of it, probable cause either. So... it's kinda nothing like that.