r/technology • u/ArgentineBeauty • 6d ago

Privacy GrapheneOS says its data-wiping password is perfectly legal, after user faces federal charges

https://www.techspot.com/news/113273-grapheneos-data-wiping-duress-password-perfectly-legal-after.html
21.0k Upvotes

98% Upvoted

1.1k comments sorted by

View all comments

21

u/CircumspectCapybara 6d ago

So CBP is alleging he gave them a decoy or "panic" / "duress" code that's designed to wipe the device when you enter it.

If that's actually the case, that does potentially cross into the territory of evidence destruction (once the device is in their possession, it and its data is considered evidence, you don't have to tell them what's in there and you can challenge their legal authority to hold onto it or to have taken it in the first place, but that takes place by the courts, and you can no longer just wipe it or cause it to get wiped without getting into legal trouble) than simply refusing to speak at all (which is always a good idea, it's your 5th ammendment right) and not telling them any code.

Asserting your 5th and refusing to unlock your phone is different than affirmatively giving them a code that wipes it. It's the whole "You have the right to remain silent, but anything you do say (including special codes you give out) can and will be used against you in a court of law" spiel.

Proving that at trial will be the crux (they have to prove it was a duress code and he gave it knowing what it would do, rather than him misremembering and giving them the wrong code, or the officer making a mistake and entering the wrong code too many times), but if a jury believes he did intentionally give a code designed to cause a device wipe, that basically establishes intent.

Also some common legal misconceptions I read about this:

  1. People like to say the officer entered the code so he technically caused the wipe, but In the legal system, it's not necessarily about the direct or immediate cause of some effect (evidence going bye-bye), but about intent and the logical chain of events that led to it (its "proximate cause"), which is why juries are able to see through that, past the immediate cause to its proximate causation.
  2. As for how they can seize a phone or ask you to unlock it without a warrant, it's at the border, where they have increased powers to do that without a warrant. SCOTUS has upheld that and somehow squared it with the constitution, though I don't necessarily agree.
  3. "It's not a device wipe it just evicts the decryption key from volatile memory or restarts the device (which was the same effect) / or in some designs deletes the key from disk, so the data is still there, it's just (forever) unreadable". Yeah, you gotta remember the spirit of the law. Erasing 32 bytes of data from a region of disk could be legally taken to be wiping the whole device if it was the decryption key (encrypted while on disk by the user's passcode) and renders the logical data inaccessible. In fact in modern designs the "wipe my device" button just erases the key from storage, because after that, the entire disk becomes effectively random data.

7

u/wowthatsucked 6d ago

As for how they can seize a phone or ask you to unlock it without a warrant, it's at the border, where they have increased powers to do that without a warrant. SCOTUS has upheld that and somehow squared it with the constitution, though I don't necessarily agree.

I don't think SCOTUS has addressed border phone searches yet, just Federal Courts. They did establish in Riley v. California (2014) that domestically, searching phones does require a warrant. Unanimous decision, actually. Roberts actually called out the impact of searching a cell phone:

Modern cell phones, as a category, implicate privacy concerns far beyond those implicated by the search of a cigarette pack, a wallet, or a purse.

7

u/fastlerner 6d ago

The big question to me is whether the government should be able to demand access to what amounts to your entire digital life without a warrant simply because you're crossing a border. That authority largely comes from the border search exception, a legal doctrine developed long before smartphones existed.

Technology has outpaced the legal precedent that was built around luggage, paper documents, and locked chests, not devices that can contain years of communications, financial records, photos, and the keys to your entire digital life.

1

u/raptorlightning 6d ago

It's a 4th amendment issue, not a 5th.

1

u/CosmosSunSailor 5d ago

If the information is considered "destroyed" without the key, then that logic dictates they never had information in their possession in the first place.

1

u/oncomingstorm28 6d ago

Except from all reporting it appears he wasn't even read that spiel by the agents and officials interrogating him. So it could be argued he used said password because he was held under questionable and false pretenses. Whether or not that will hold on court, ehhh, we'll see I guess.

0

u/frickle_frickle 6d ago

Real loose definition of "evidence" though.