Forgot your password?
typodupeerror
Privacy Android Operating Systems

GrapheneOS Defends Data-Wiping Function That Blocked US Border Search (pcmag.com) 182

GrapheneOS is defending its duress-password feature after an environmental activist used it to wipe his Pixel phone during a U.S. Customs search and was later indicted for allegedly destroying property under government control. The nonprofit says the operating system is "completely legal," cannot recover the erased data, and should not be weakened with encryption backdoors. Meanwhile, the activist faces up to five years in prison if found guilty. PCMag reports: In a post on Saturday, the Canadian nonprofit behind the operating system, the GrapheneOS Foundation, explained that the software offers a range of features to prevent data extraction. For example, one safeguard is the "auto-reboot timer" that'll reboot a locked device after a set period of time to put the data at rest, leaving all files inside encrypted.

The group's post subtly suggests that GrapheneOS phones can withstand law enforcement searches without requiring users to resort to a duress password. "People should carefully consider how to use it in an actual duress situation where there can be physical or legal consequences for wiping the device," the nonprofit wrote. "GrapheneOS doesn't require it to protect data from being extracted from the device, but it takes recovering it completely off the table even with the PIN/password for each profile on the device."

On X, the nonprofit has also said it can do nothing to help US law enforcement recover data from Tunick's phone. "Data cannot be recovered after the key derivation material is reliably wiped. It's not possible and there's nothing we can do to assist with it," the group wrote. "Similarly, it's not possible to assist with bypassing encryption because the hardware and software has been designed to prevent it."

This discussion has been archived. No new comments can be posted.

GrapheneOS Defends Data-Wiping Function That Blocked US Border Search

Comments Filter:
  • by ArchieBunker ( 132337 ) on Tuesday July 28, 2026 @01:08PM (#66261130)

    They're going to make an example out of him and give him the maximum.

    • Isn't there a PC OS that can do nesting dolls of instances so your duress password just unlocks a boring OS with some dumb stuff in it that doesn't appear interesting? Might be something to make here, not like modern phones don't have enough storage for it.
    • Re: (Score:2, Interesting)

      by Targon ( 17348 )

      There are some basic issues at play here, such as there needing to be reasonable suspicion that any sort of crime has been committed before any sort of search or seizure of property. Since ICE is not known for getting a warrant, just going over the border does not mean there is a REASONABLE suspicion that anything wrong has been done. Since the government does not have a right to just take personal property then, they have no realistic case to charge someone for destruction of ANYTHING the person actual

      • There are some basic issues at play here, such as there needing to be reasonable suspicion that any sort of crime has been committed before any sort of search or seizure of property.

        This isn't (necessarily) true at a U.S. border and there are currently different rules, from different federal courts, depending on where you are entering the U.S. There is no reasonable suspicion or probable cause requirement in many states - for example if you fly from Europe into New York or Virginia . This article lays them out.

        No Warrants and Half a Dozen Different Rules: The Convoluted and Dangerous Status of the Border Search Exception [cdt.org]

        • by AmiMoJo ( 196126 )

          I thought all this had been common knowledge for decades. You never take your phone through customs without at least wiping it well in advance, and then restore it when you have arrived and are secure. Or even better, you take a burner with nothing of interest on it, because if you take your main phone it might get stolen or "damaged" at the border.

          Same with laptops. Mine gets factory reset and restored from an image at the hotel.

    • they can try but its going to fall apart before you even get into the Constitution issues. what i mean there gonna say evidence search you reply of what they wont have a answer, they might say a crime and again what crime was i being charged with. the case is dead.
  • by Casandro ( 751346 ) on Tuesday July 28, 2026 @01:11PM (#66261132)

    ...or at least not one that has valuable data on it. Didn't people learn from the DMCA?

  • The standard is literally that you think a court might ask for it, or it might be relevant to a case.

    This is exactly why you don't do this, as we just discussed.

    • What case? He wasn't being investigated for committing any crime.
      • The laws at border crossings get murky. If you're stopped for further questioning that's considered an official investigation.

        • by Targon ( 17348 )

          And it still comes down to, "Why was he stopped?" in the first place. ICE isn't known for actually following the law, in the same way that Donald Trump himself isn't known for following the law, or even the rules of basic human decency.

          • And it still comes down to, "Why was he stopped?" in the first place.

            And it still comes down to security measures in place which are described in the bipartisan USA PATRIOT buttfucking-your-freedoms act.

            ICE isn't known for actually following the law, in the same way that Donald Trump himself isn't known for following the law, or even the rules of basic human decency.

            Guess what? Neither is any other part of the US Government. You name it, our government has done it, including coups, assassinations, coups, genocides, false flags, drug trafficking, human trafficking, willfully selling munitions to international criminals... and most of it within our lifetimes. Yes, Trump is a gigantic piece of orange shit, but this country was doing plenty

      • by Himmy32 ( 650060 )
        The CBP in this case are claiming that he was being investigated for CSAM and that there was individualized reasonable suspicion for a federal crime.
    • by Archangel Michael ( 180766 ) on Tuesday July 28, 2026 @01:55PM (#66261262) Journal

      IF that is the case, seize the phone, get a Search Warrant.

      The problem is, the state couldn't be bothered following ESTABLISHED law and procedures.

      Simply accusing someone of some unspecified crime isn't a right the state has to just bypass Constitutional protections, namely the 4th and 5th Amendments.

      Americans have rights, secured in our founding Constitution. I don't care what feelings one might have to the rest of the case. Rights exist, enshrined and we ought to defend them tirelessly forever.

      • IF that is the case, seize the phone, get a Search Warrant.

        The problem is, the state couldn't be bothered following ESTABLISHED law and procedures.

        This isn't (necessarily) true at a U.S. border and there are currently different rules, from different federal courts, depending on where you are entering the U.S. There is no reasonable suspicion or probable cause requirement in many states - for example if you fly from Europe into New York or Virginia - or Georgia. In this case, the guy flew into Atlanta and no suspicion is required on entry tot he U.S. for a forensic search in Georgia. This article lays out the various situations by state.

        No Warran [cdt.org]

      • by Himmy32 ( 650060 )

        Theoretically the border search exception [wikipedia.org] doesn't change an individual having an reasonable expectation to privacy under the 4th, but that what's considered reasonable is different when crossing the border.

        It has to be reconciled with other searches like making cure someone isn't bringing in diseased produce, like looking for a smuggled kiwi in a carry on versus looking for a banana under the seat during a traffic stop.

        The big problem is that searching phones doesn't pass the Katz test to a reasonable expec [wikipedia.org]

    • But does a border search of a US Citizen have such standing as a court order or warrant? What was the basis of the request to inspect the device-- was there information that he could be a child pornographer, or was he just on a watch list because of his occupation?

      Can a prosecutor prove beyond a reasonable doubt that it was wiped with a duress password with the intent of hiding criminal activity, or maybe it was wiped in advance? Can the prosecution get a court warrant to search the individual's home based

  • If you use Google or other mainstream search engines you can't find out who Samuel Tunick is or what his activism is centered around. The cop city protests are way more important than most Americans realize as they constitute what is essentially a domestic military occupation. Unlike military bases, these are meant to suppress the general population in mass.

    The Guardian reported in February that surveillance cameras hidden in utility boxes mounted on light poles had begun appearing outside the homes of

  • Notice how the "free press" keeps talking about this as a "law enforcement problem" but hasn't once talked about any time somebody was threatened by a mugger to unlock and this safety feature saved their bacon?

    #include <obligatory.xkcd>

    Most common criminals will run when there is nothing further to be gained.

    Big organized crime gangs, such as people at the border threatening travelers under color of law, are the exception rather than the rule. They got embarrassed that their dominance play didn't wor

  • So if the government unlawfully confiscates your property without your consent, it is then their legal property, and they can punish you for doing anything to it? Even if a program to erase the data on it at a specific time was set up before they illegally confiscated it? I have some serious doubts about that legal theory holding up in court. Sounds like it would go really quick: Defendant: "I had no idea the phone would do that, and they wouldn't let me stop it from doing that!" Judge: "Case dismissed!"
    • It will probably come down to how good a lawyer the guy can afford.

  • Superman II (Score:4, Funny)

    by JoeyRox ( 2711699 ) on Tuesday July 28, 2026 @01:29PM (#66261176)
    In January 2025, US Customs agents demanded the device's password during a search at the airport...When Tunick provided a password for his phone, it was actually a "duress password" that irreversibly wipes a device when entered.

    Reminds me of when Superman was forced into the crystal chamber that his captors thought would render him powerless but it was his captors who were made powerless.
  • "Similarly, it's not possible to assist with bypassing encryption because the hardware and software has been designed to prevent it."

    I have no idea whether it's true in this case, but it seems like we've heard things in the past that sounded similar that turned out not to be true.

    • by 0123456 ( 636235 )

      If you securely delete the encryption key, the data is irretrievable. This is how many (all?) modern SSDs work, for example, so they can be wiped without having to overwrite or erase all the data... just send it a command to generate a new encryption key and suddenly the disk is full of garbage.

      Yes it could be done incompetently but it would take a very high degree of incompetence to screw that up.

    • "Similarly, it's not possible to assist with bypassing encryption because the hardware and software has been designed to prevent it."

      There's an aphorism in encryption development: "anyone can design an encryption system strong enough they personally can't figure out how to break it."

      Problem is, of course, that someone else might figure out how to break it. I think we can expect that to eventually happen to any encryption system. It's a matter of when it will happen, not whether. Of course, if "when" is 50 years from now, that's effectively forever.

      This is why "I'll write a new encryption system" is almost always the wrong answer. Not alw

      • "No human can invent a lock, meant to be opened, that another human cannot figure out how to unlock."

        — Me

        Our history is replete with instances of this and it always holds true. Given enough time and resources a lock meant to be opened can and will be opened by someone without the key. When you add computers to the mix, things get real interesting, really fast...

        • by 0123456 ( 636235 )

          If the key is randomly-generated and securely destroyed and they use some common believed-secure algorithm like AES then there's not enough time or atoms in the universe to brute-force it.

          • by gr8dude ( 832945 )

            > If the key is randomly-generated and securely destroyed and they use some common believed-secure algorithm like AES

            - IF it is randomly generated;
            - IF it is securely destroyed;
            - IF they use a common algorithm;
            - IF they use a correct implementation of that algorithm...

            The underlying mathematics is not what you usually attack, but rather one of those IFs.

        • by Bahbus ( 1180627 )

          Given enough time and resources a lock meant to be opened can and will be opened by someone without the key. When you add computers to the mix, things get real interesting, really fast...

          The encryption used would take current super-computers billions of years to crack. And that is assuming the key is still present and available to crack.

          In the case of duress, Graphene securely deletes the key itself. There is not enough energy in the entire known universe that would allow any kind of computer(s) to essentially guess/reverse engineer what the key was.

          By the time any computers are good enough to break, or reverse, this level of encryption, a newer, better encryption will have already been imp

      • by necro81 ( 917438 )

        Of course, if "when" is 50 years from now, that's effectively forever.

        Neal Stephenson, Cryptonomicon:

        The longer the key you are trying to generate, the longer this takes. Randy is trying to generate one that is ridiculously long. He has pointed out to Avi, in an encrypted e-mail message, that if every particle of matter in the universe could be used to construct one single cosmic supercomputer, and this computer was put to work trying to break a 4096-bit encryption key, it would take longer than the lifespan of the universe.

        “Using today’s technology,” Av

  • attempts to outlaw security features such as those in Graphene OS.

    But that' probably won't get that far:

    The U.S. government cannot easily or successfully outlaw the security features found in GrapheneOS due to insurmountable First and Fourth Amendment constitutional hurdles, alongside the practical realities of open-source software. (source EFF)

    While lawmakers frequently attempt to target encryption and anti-forensic features under the guise of national security, any blanket ban would face immediate defeat

    • "The only solution" is in fact, not the "only" solution.

      The correct and LEGAL means for the police to gain access to the phone is to take it and seal it in a tamperproof container (aka electronic Faraday Evidence Bag), go to a court and ask for a warrant to search the contents.

      We have established LAW and procedures for the state to gain access to the device. It is inconvenient ON PURPOSE. and serves as a checks and balance in legal proceedings.

      • by hwstar ( 35834 )

        The problem with this is that Customs and Border Patrol doesn't get search warrants, they operate under the "Border Search Exception"

        No search warrants are required unless congress acts, or the Supreme Court changes its mind. See below for a the Fourth Circuit court case.

        The border search exception lets U.S. Customs and Border Protection officers search travelers and property at national borders and international airports without a warrant, probable cause, or suspicion, based on the nation's right to prote

  • He owns the phone. He owns the data. They can fuck off. That's my interpretation of US law. See also 4th amendment rulings on if someone has to turn over a password or unlock code or decryption key or not.
  • Obviously not under government control, because they had no access to it, and it wasn't theirs anyway.
  • Isn't this similar to what someone did to Jeffrey Epstein?

  • Yeah, right. People that actually know how to be careful do not need this feature, because they do not trust their phone or at least wipe it carefully before crossing any dangerous border like the US one. The people that use this feature are already careless idiots by that fact alone. Better to not have the feature at all. It is like an explicitly designed in "shoot yourself in the foot" function on a gun.

    • by Bahbus ( 1180627 )

      Nah. Governments and border enforcement can lick my nutsack. I'll make them wipe my phone for me every single time. And while it's wiping I'll have it play Fuck Tha Police by N.W.A while displaying animated middle fingers.

      • by gweihir ( 88907 )

        Have fun in prison.

        • by Bahbus ( 1180627 )

          I would. But it's never going to happen. At least, not for anything like this. And they don't have access to a lawyer good enough to get me in court. And I don't go to countries were court isn't an option.

          If I'm gunna go to jail, it'll be for violence with at least one arresting officer permanently injured, or disfigured, for the rest of their life. I'll give them a fair warning though.

          • by gweihir ( 88907 )

            Primitive "I am so tough" posturing. Either a lie and you will be too much of a coward to ever actually risk it or at some point you go away for life as a violent criminal. In any case, just a sure sign of deep insecurity.

            • by Bahbus ( 1180627 )

              Either a lie and you will be too much of a coward to ever actually risk it

              I will be risking nothing. Nothing that matters to me anyway.

              at some point you go away for life as a violent criminal,

              Prison isn't a punishment to me, so doesn't matter. Also, violent criminals rarely get sentenced to life in prison unless they kill someone (in the US).

              In any case, just a sure sign of deep insecurity.

              Nope. Just a refusal to be pushed around and bullied by a shitty system (or shitty people). Stand up for yourself. Have a fucking backbone. And if they're going to take you down on BS no matter what, then make them pay heavily for it and make the time your going to spend worth it.

  • The exact wording in The Guardian is as follows (my emphasis):

    Agent Findley and several others repeatedly asked Tunick to open his phone during the interrogation, telling him they would seize it if he did not.

    In my opinion, this means that at the moment he provided the PIN, the phone had not yet been seized and was therefore not yet under the control of the government. Again, in my opinion, this means he did nothing illegal because it's the same as if he'd wiped his phone as soon as the plane took off. In

  • The only thing it didn't do is post an image of a middle finger on screen after it was done.

    The folks who create the OS needs to rethink their approach of how they wipe user data from
    the device vs going nuclear and wiping everything.

    Why not put all user data into their own home directory ( see most other Operating Systems )
    and securely wipe ONLY that directory upon entry of a duress code or bad pin entry X number
    of times. Perhaps give the user the option to select / flag which sub-directories to purge and
    wh

    • Oh I bet you could leverage corporate MDM functionality for more or less the same thing, now that I think about it.
  • Regardless if he did anything legally wrong, there is a better way to handle this situation. Before you travel, backup your phone to a hidden encrypted volume, then wipe the phone. Set a dummy passcode that you can give out at the border, and be assured you're safe. That being said, he wasn't presented with a warrant to force handing over or retaining evidence, so what is he guilty of?

    All he has to argue is that he was never presented with a warrant, and therefore the requirement to retain evidence didn'
  • The charge is deleting data on a device while under the government's control which I believe could be argued that if the government needed a password to access it, it was not under the governments' control.

  • Is a device really under government control if the government doesn't know the PIN? Or if the government is so naive as to enter a PIN that wipes the device?
    • by Himmy32 ( 650060 )
      Legal definitions are different than layman definitions. And even then that's starting to get into the sovereign citizen level of philosophical chicanery.
  • Was he NOT in custody? How could he have done this? Like if he was in custody then using his voice can't be illegal. If he told the officer to go shred the incriminating evidence and they did would he be liable then?

    This is on some borders that have not been well defined. For one suspects are seized and forced to supposedly compel speech. It is literally a compelled speech under duress which means anything setup on his device to detect that which was done prior to the encounter simply falls under the guise

    • then you get into what where they searching for they wont have a answer and what crime was i being accused off another no answer. this has no chance in court. this will fall silent in a few weeks and you will never hear about it again.
  • The duress deletion function was always obviously and transparently going to get treated as obstruction of justice issue the minute it got used in a high profile case. Here we are.

    If you don't want to have trouble at the border, wipe your devices before you get anywhere near, and restore them once you are across. The precursors to this event have been in the news for years - the border is a legal gray zone, act accordingly.

    I have mixed feeling here - sad for this kid, whomever he may be. Once again annoyed

  • (a) Destruction or removal of property to prevent seizure.--Whoever, before, during, or after any search for or seizure of property by any person authorized to make such search or seizure, knowingly destroys, damages, wastes, disposes of, transfers, or otherwise takes any action, or knowingly attempts to destroy, damage, waste, dispose of, transfer, or otherwise take any action, for the purpose of preventing or impairing the Government's lawful authority to take such property into its custody or control or

  • 1. GrapheneOS is completely in the clear here - one can certainly have a data wipe feature in a device. Indeed there are entirely different scenarios from the current one where it would be of value, such as theft or kidnapping.

    2. USING that feature, the way this individual did, is illegal. This is similar to a basic gun issue. It can be perfectly legal to own a gun and use it in certain ways, yet it remains illegal to use the gun to shoot an immigration/customs official. This is NOT something the current ad

Anything cut to length will be too short.

Working...