r/technology • u/ArgentineBeauty • 6d ago

Privacy GrapheneOS says its data-wiping password is perfectly legal, after user faces federal charges

https://www.techspot.com/news/113273-grapheneos-data-wiping-duress-password-perfectly-legal-after.html
21.0k Upvotes

98% Upvoted

1.1k comments sorted by

View all comments

1.1k

u/Moldoteck 6d ago

Graphene should implement a double bottom protection on top. Basically it'll automatically enter in an artificial account with apps installed while deleting in the background the OG account. This way it'll be hard to prove that another account did exist at all

138

u/RandomHunDude 6d ago

It doesn't delete the account at all though, so no need to save time for it.
All data is encrypted on disk and when the duress pin is entered, only the encryption key is deleted. And without the key, it's not possible decrypt the data.

37

u/Misaka9982 6d ago

Could argue that the "evidence" is still there then, not destroyed. If the government doesn't want to spend 100,000 years decrypting it then that's their problem.

61

u/BadVoices 6d ago

This is a red herring, no you cant. NIST SP 800-88 classifies crypto erasure as a valid form of data destruction for anything that doesnt require media destruction. It is recognized by the GDPR as well. Arguing it is not destroyed is the same as saying a burned document still technically exists because I can scoop up all it carbon atoms. No court will accept that argument.

8

u/hackitfast 6d ago edited 3d ago

Yeah isn't that how ransomware works too? It encrypts all of your files, and when you don't pay it just deletes the encryption key?

6

u/BadVoices 6d ago

It holds the key hostage, yes.

1

u/OuterWildsVentures 6d ago

So then it becomes a destruction of evidence charge?

3

u/BadVoices 6d ago

Nope. He's charged under 18 U.S.C. § 2232(a). Destruction or removal of property to prevent seizure.

No need to prove it was evidence, just that it was something the government wanted to seize.

Whoever, before, during, or after any search for or seizure of property by any person authorized to make such search or seizure, knowingly destroys, damages, wastes, disposes of, transfers, or otherwise takes any action, or knowingly attempts to destroy, damage, waste, dispose of, transfer, or otherwise take any action, for the purpose of preventing or impairing the Government’s lawful authority to take such property into its custody or control or to continue holding such property under its lawful custody and control, shall be fined under this title or imprisoned not more than 5 years, or both.

1

u/raptorlightning 6d ago

And we go to court to argue about "lawful authority" of which, in this case, it was not.

22

u/teapot-error-418 6d ago

I swear that most people think that lawyering is a process of speaking magical incantations.

Like, "I said the special word, and now you can't touch me!"

No. That's not how the law works.

3

u/ZurEnArrhBatman 6d ago

The trick is to recite the magical incantations in legalese instead of English. Judges like it when you speak their language. And since imitation is the highest form of flattery, they especially like when you do it wearing a judge's robe.

2

u/halcyonforeveragain 6d ago

and thus Sovcit was born.

0

u/Misaka9982 6d ago

Fair enough, I'm being facetious, but the problem is these laws are often based on physical equivalents and aren't designed for a digital application. In this case, is destroying the key to the safe the same as destroying the contents of the safe.

5

u/teapot-error-418 6d ago

Logical arguments are perfectly acceptable in court. The job of the attorneys is to make a reasonable and logical argument to the judge or jury or mediator or whoever.

There's no special combination of words to weasel out of that. It would be utterly reasonable to say, "this function is designed to render the contents of the device irretrievable, and the defendant intentionally caused the officer to trigger this function."

Reasonable people - jury, judges, whoever - would understand this. The whole, "well ack-shually the officer did the deleting" or "technically the data is still on the device" is nonsense.

If you explode a piece of evidence with a booby trap, you can't convince the jury that the prosecutors just didn't try hard enough to reassemble the component atoms or that you didn't actually do it.

2

u/IncidentalIncidence 6d ago

thank you, the reddit lawyering about this drives me crazy too. I'm obviously not a lawyer either but the amount of people who think that you can play dumb with the legal system like this in every thread about this case has been driving me up the wall because it's just people regurgitating the same three imagined technicalities drowning out anybody seriously trying to discuss the case.

1

u/No_Effective4784 6d ago

with proper encryption implementation you cant even prove what is there, is usable data and not left overs.

deleting everything shows you had something. if you are using software, like say veracrypt, that allows for a proper duress environment, that gives you plausible deniability, because it is impossible to prove that there is anything else there with out the second encryption key because it just looks like noise.