According to the article, he was actually using GrapheneOS and gave the border official the Duress PIN. So I guess technically it was the official that erased the data :-)
"I wired a bomb to the safe which triggers if you enter a given code. When the police asked me for the safes code I gave them that code, so it was technically the cop that killed himself and his colleagues"
Or even
"A soldier stepped on a landmine but since it was his footsteps that triggered the mine he technically killed himself"
I wonder whether it'd be better for a duress PIN to delete existing data and also create a semi plausible artificial profile to hide the deletion event.
Deleting arbitrary directories, messages and app data would be highly unreliable. There's a high likelihood of the data being recovered. It's not how computer filesystems and storage are designed to work. Reliable deletion of data requires setting it up to be reliably deleted later on by having it encrypted on storage with keys which can be reliably prevented from ever being obtained again.
Wiping the overall data on the device via a factory reset, OS recovery mode or duress PIN/password prevents recovering any of the data because it reliably wipes material needed to derive key encryption keys and also reliably wipes the encrypted disk encryption keys. Wiping the encrypted disk encryption keys alone would not be good enough because they're stored on the SSD so imaging the SSD and restoring it could preserve the ability to recover the data. The way the key material needed to derive the key encryption keys is wiped prevents recovery via imaging the SSD mainly due to the secure element.
There's already support for reliably wiping data at the granularity of Private Spaces and secondary users. Those have their own encryption keys and can be reliably deleted due to having their own Weaver slots in the secure element and other hardware-based security integration.
Apps can also assorted generate encryption keys in the secure element and use those to encrypt data where it can be reliably deleted via wiping the hardware keystore keys. That requires apps built to have granular storage and encryption of their data.
Despite it being possible to wipe a secondary user or Private Space reliably, the past existence of it and when it was wiped will be easily discoverable via the main Owner user and system data. Preventing discovery of those profiles having existed requires an overall wipe of the data. It isn't feasible to hide it without doing that and hiding it would involve a whole bunch of unreliable removal of data without a way to prevent recovery along with redoing a bunch of statistics and other metadata to hide that there was another profile until recently. For example, things like the battery and data usage stats directly refer to the profiles. Even hiding it from naive analysis not looking at the leftover data on storage would still require changing a bunch of things to hide it.
Making data deletion of the data reliable for a whole profile or the whole data partition also requires a reboot or shutdown. Consider how much data gets loaded into the page cache and many other forms of data in the Linux kernel and other processes. Consider how much linger around in various kinds of registers, etc. including outside of the OS itself. Reboot or shutdown has code to get rid of this and the device sitting there turned off or booting again also gets rid of it.
They were clearly going to hook his phone up to forensics software on a laptop and had done what they needed to do in order to justify it for their own policies. It would not make sense to set up everything they did simply to have someone non-technical manually sift through his apps. They have widespread access to forensic software and also more advanced software with exploits. They definitely have easy access to it at a major Atlanta airport. The adversary in this case is not a non-technical human but rather advanced software from Cellebrite who are fully aware of alternative operating systems and document information on it. Their documentation directly refers to GrapheneOS and has tables listing their (currently very limited) capabilities against it.
This story got widespread news coverage and is widely known about. That should help make it clear how important it is for features to work against adversaries aware of these kinds of features. Our duress PIN/password works against adversaries aware of it. If they don't coerce a PIN/password from someone or don't enter a coerced PIN/password because they know it could be in use then the feature has worked. We want to improve the feature with secure element rate limi...
> Reliable deletion of data requires setting it up to be reliably deleted later on
I mean - yes? If you design a subtle duress pin that only hides certain things, users would have to choose what.
I myself want the bank apps, password manager and email to disappear without a trace, but I don’t care about the social media, photos or web browser history. Other people, though, will have different priorities.
> I mean - yes? If you design a subtle duress pin that only hides certain things, users would have to choose what.
That's not what we were talking about. This is the full sentence we wrote:
"Reliable deletion of data requires setting it up to be reliably deleted later on by having it encrypted on storage with keys which can be reliably prevented from ever being obtained again."
What we're saying is that in order to have fine-grained deletion of data, it has to be encrypted with fine-grained keys with hardware support for deleting those keys reliably. Reliable deletion of data should also not be confused with stealthy deletion of data which is not generally possible for the kinds of data being discussed.
> I myself want the bank apps, password manager and email to disappear without a trace
You can put all of this into a Private Space or secondary user where it can be reliably deleted as a whole. There will be no way to recover any of the data if the profile is deleted. We have a planned feature for either a toggle to make the duress PIN/password only delete specific secondary profiles or more likely a 2nd duress PIN/password with that different purpose.
Deleting secondary profiles will reliably prevent recovering any of their data, at least after a reboot or shutdown. The best way to do it would be deleting them and then rebooting where the main user and secondary profiles not included in the deletion would still be there after the reboot. Without the reboot, it's unrealistic to reach the point where it's truly highly reliable. The OS does purge the keys for a secondary profile but a lot lingers around in system processes, page cache and elsewhere. If you delete a secondary profile with the goal of preventing data recovery then it's a good idea to reboot afterwards.
Dividing things up into secondary users is the way people can set up having fine-grained reliable deletion of the data. We can expand our duress PIN/password feature to support working with that.
It should be noted nothing about wiping secondary profiles is stealthy. It's very obvious there were profiles and that they were wiped. It can be determined when it happened and approximately how much data was deleted too. The data and filenames are unrecoverable but a fair bit of metadata on the sizes of files, etc. can be recoverable because that metadata is globally encrypted rather than per-profile encrypted. If you want to delete absolutely all traces of it in a reliable way, an overall wipe of the device does it extremely well. If you delete a profile then nothing encrypted by it can be recovered but what about all the evidence of it existing in the system and Owner user data? It's in the battery statistics, data usage statistics, package manager metadata and many other places. It can be purged from those but absence of data can be detected, and there's the usual problem of simply not being able to reliably delete data from computers in a fine-grained way. It's too late to reliably delete data from a file after the file has been regularly rewritten and modified.
Deletion needs to happen through deleting the keys used to encrypt all data which was ever stored in the file, so it would have had to be set up with that in advance. To reliably redact data in a file, the file would need a dedicated hardware-backed key with a new one being generated and the old one wiped as part of redacting data. Reliable wiping of a profile or the overall device works because it's all encrypted with filesystem-based full disk encryption using keys which can be reliably deleted. Profiles have fine-grained encryption for filenames and file data.
You cannot retroactively decide you want to reliably delete the data of a specific app and then do it. It's already spread all over the place. You'd need to wipe the whole profile or the whole device if it's not in a secondary profile. The OS would have had to set up a dedicated encryption key for that app's data with hardw...
I think for the case we're talking about here, though, it would be doable. This doesn't need to thwart deep forensic analysis. It just needs to survive a border agent thumbing through the contents of your phone for a bit. If the fake profile data looks plausible, and doesn't raise any flags, the agent gives the phone back and you're on your way.
Hell, I think a setup that doesn't wipe anything, but just drops you into a sanitized, isolated profile for the border agent to look at, would be fine for many users. Certainly you wouldn't want to use this in truly high-stakes situations where it's likely that your device will be confiscated no matter what, and analyzed to death, but for the simple "border agent wants to snoop on my data for a few seconds" case, it's likely sufficient.
(As always, risk analysis can be hard, humans are often bad at it, and not everyone's threat model is the same.)
Maybe it could cause the phone to "randomly" bootloop or something? "Oh no, my phone is broken again, last time this happened I needed to do a factory reset"
Have a phone with crappy battery and have it trigger a high processor load to take the battery voltage drop and turn off the phone? (Eg what Apple tried to prevent with the batterygate thing).
This case happened precisely because the officers noticed the phone flash and reboot when they entered the pin. IIRC they didn't make a fuss over it, but time later he got charged over the event.
So whatever a duress pin does, it has to be subtle enough that anyone looking doesn't link it to the act of entering the pin.
> I wonder whether it'd be better for a duress PIN to delete existing data
Reliably deleting data at the scale of the whole data partition, a secondary user or a Private Space is fully supported but requires a reboot or shutdown to truly complete it.
After wiping key derivation material needed to obtain the key encryption keys in multiple ways and wiping the encrypted disk encryption keys, the OS can still access the data. It still has data in the page cache, in registers and elsewhere. There are still a bunch of system processes with data tied to what was removed. The OS is still fully functional after the nearly instant wipe of everything needed to recover the data again. It can still access all data other than what's encrypted with hardware keystore keys and not currently decrypted.
The wiping process for the duress PIN/password is completed with a shutdown which tears down everything, zeroes memory and provides at least a small time window where the hardware is powered off too. A reboot would also work and the boot process has explicit zeroing of memory, registers, etc.
We decided to use shutdown for the duress PIN/pasword but a reboot is a valid approach too. Our locked device auto-reboot timer feature we first shipped in 2021 relies on the zeroing done by GrapheneOS for both the process of the OS tearing down and then again during booting to return the device to Before First Unlock state.
> also create a semi plausible artificial profile to hide the deletion event.
It isn't feasible to fool forensic software so it largely wouldn't work against state actors. It nearly certainly wouldn't have helped in this situation in the news. They aren't reliant on a non-technical person sifting through a phone. They'll just hook it up to a laptop and follow the data extraction procedure which involves enabling ADB. The software is aware of GrapheneOS can guide people through dealing with anything different about it. They've had a lot of trouble with extraction via ADB for GrapheneOS since the vulnerabilities they exploit via ADB keep getting patched or blocked it exploit protections but it isn't realistic to block extraction with them having the PIN/password. They could just enable the encrypted backup service in the OS instead and then use CLI tools to extract the data from there with the seed phrase. They don't do that because they want everything rather than only nearly all app data. They also have special code to deal with apps such as Signal with their own layer of data encryption since the data taken from their app data directory is nearly all useless by itself.
There's also quite a difference between wiping and rebooting into a not very plausible environment with decoy data set up by the user in advance compared to not properly wiping and giving access to a decoy profile. Bear in mind the OS can still access nearly all data after the wipe until a reboot. It could make a best effort attempt at purging as much as possible from memory, but the OS is not designed to continue functioning with all of the data disappearing. It can't just wipe all loaded encryption keys without crashing and rebooting anyway. It also has a ton of data still around in caches and elsewhere. We don't want to just do a best effort job cleaning up as much as we can but rather reliably prevent recovering any of the deleted data.
We could definitely add a duress PIN/password which wipes only specific secondary profiles, reboots and has the device still functional with whatever data was in the main user still there. That's a feature we can add, but it's important to note that it will not hide that there was deletion of data. It's easy to detect, and it's not feasible to hide that it happened. Many steps can be taken to make it less obvious, but it will still be easy for software aware of it to detect. Even a massive overhaul designed to perfect it would not address the SSD itself giving away what happened for more advanced anal...
>I don’t think that would fly as a defense in court
but that's not the point, the point is to not wind up in court by presenting a phone that no long contains evidence but seems plausibly like your phone so doesn't arouse suspicion
No, to my knowledge, they ask you to enter your PIN/password yourself. They don't enter it for you. I believe he entered it himself, at which point the erasure began.
> Tunick provided this code to an agent, who entered it on the phone, after which “the screen went blank, flashed several times and the phone appeared to restart.”
So the real problem in the end is that your duress system should not put a big message "erasing all data" but "loading" slowly and just look mostly empty.
They don't add features that rely on security through obscurity, would give attackers tons of attack surface, is physically impossible to make actually deniable, and could put regular GrapheneOS users in physical danger in authoritarian regimes.
I mean, it sounds like it would be even better if the duress response was more subtle.
A duress code might let me wipe my phone when someone holds a gun to my head and demands I unlock it. Problem is, there’s still someone holding a gun to my head.
He had an e-reader and phone. My solution would be set the phone's duress pin to the e-reader's actual pin then consent to the e-reader search providing its pin and see what happens.
The actual solution is cloud backup + re-image after the border.
Not how the law works. If I put a bomb in a box. It will explode if a certain pin is put in. And you ask ”can I open the box? What is the pin?” And I say ”here is the pin to open it” and the bomb explodes. Do you think I can claim they blew up themselves ?
An analogy should not be judged on whether or not it can realistically happen, nor whether it can be manipulated in some way that capitalizes on the differences.
Because the point of an analogy is not to provide an realistic or identical situation. On the contrary, the point of an analogy is to use a different situation in order to illustrate a very narrow similarity and make a point.
If the analogy illustrates and makes that point well, then it succeeds.
I never told you it is a box with a bomb. You just asked if you can have the pin. You can do another example where you give false information with the intent of making another person take an action that they don’t wanna take and would not take unless you had provided false information. You are causing the action to happen. Just like if you yell fire in a theater. You didn’t stamped anyone to death. But your words caused it.
It's a pretty good analogy. Of course the phone isn't a bomb, but the parent comment's point holds: whose hands inputted the pin is just a technical trivia.
Or smarter yet, not bare. Looks like a normal phone - innocent-looking vacation photos, innocent-looking social media accounts, innocent-looking email....
Paywalled, but what is the actual charge? Is it some extremely generic "obstructing an investigation" one? The US is quite good about making court documents available on line, if someone can find it.
I'm a bit mystified why anyone would bring an electronic device over an international border with anything that could be construed, fairly or not, as evidence of criminal behavior.
Great link. The most relevant part for me is the last couple minutes (22:00): it's only against the law to destroy evidence if it can be established that such evidence exists. This feels like a more elaborate version of accidentally losing a stack of papers to a gust of wind just as you hand them over.
1. Was there a lawful entitlement to the papers?
2. Were the papers protected private property?
3. Were the papers released to the wind intentionally?
4. If intentionally released was it expected that they would disappear or simply fall to the ground?
A couple easy technological analogies:
3. "Sorry, I gave you the wrong code by mistake."
4. "I thought it would go to a private guest mode, not delete everything!"
"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."
Amendment 5:
"..nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation."
But the bar for hauling someone to court and defacto punishing them financially and smearing them in the eyes of the public is so low. And the path to getting compensation for wrongful prosecution so fraught. What an easy tool the justice system is to punish uppity citizens thinking they don't have a king.
You think they'll see a courtroom? Ha! If they're lucky they'll get there in 5yr and $15k.
When the administrative enforcement bureaucracies want to harass you they'll hit you with some ruinously expensive civil fine BS. No court will give a crap about you until you've exhausted a bunch of appeals, which you of course appeal to the same agency that's trying to screw you. Only after years of that (and invariably legal fees, because you can't go it alone), do you sue them and get to see a real courtroom. But even then, this is a civil matter, not a criminal one, so all your rights have been nerf'd and there's a hundred years of precedent and case law that tilt things in their favor. If you get lucky, they'll settle and you'll only be out a few tens of thousands for the ordeal.
The Supreme Court has long recognized a border-search exception to the Fourth Amendment’s warrant requirement. In United States v. Flores-Montano, the Court looked to the nation’s sovereign “interest in protecting . . . its territorial integrity” to justify such searches.3 In United States v. Montoya de Hernandez, the Court stated, somewhat more narrowly, that Congress is the source of the executive’s power. It explained that “[s]ince the founding of our Republic . . . [Congress has] granted the Executive plenary authority to conduct routine searches and seizures at the border, without probable cause or a warrant.” The Commerce Clause permits Congress to authorize the seizure of goods at the border.
> While the Supreme Court has long recognized a border-search exception to the Fourth Amendment’s warrant requirement, it applies to only two interests: promoting the duty regime and preventing contraband from entering the country; and ensuring that individuals are legally admitted.
The only reasons allowed for border searches are ensuring that individuals are legally admitted (inapplicable here because citizens are always legally entitled to enter) and preventing contraband from entering.
A wiped phone can't contain contraband, so wiping the phone serves the same purpose as a search. It's not destroying evidence anymore than throwing away a water bottle before going through TSA is destroying evidence.
> A wiped phone can't contain contraband, so wiping the phone serves the same purpose as a search.
While this is the most compelling argument I've seen surrounding this case and this specific context, the initial attempt to enter with the contraband is likely a crime on its own - partial entry has already happened, the acts in question happened on US soil.
Imagine applying the same concept to drugs (and "body is a container" was found unconstitutional long ago, so no need to opine there) - if you're subject to a search and you eat drugs, does that somehow absolve you of the original attempt to smuggle?
this is a nonsense statement. yes, unfortunately format logic is wholly inadequate to express what we need in the creation and application of laws. so yes, fuzzy issues about the intent of the law and the intent of the accused some into play, along with a healthy schmear of cultural norms.
but to say that the laws and precedence aren't largely concerned with building some semantic context, and that lawyers don't build chains of reasoning in that framework to prophet their positions is absolute nonsense.
you're positing a world where a judge just rules entirely on feels, and I think most judges would be quite offended by that notion.
Sure lawyers rely on semantics. But I said “silly semantics”.
Claiming that destroying evidence of a crime proves no crime was committed is the logic of a 1 year old who thinks the world disappears when they close their eyes.
The border search exemption can't be used for general purpose law enforcement; only for determining if the person should be allowed to enter the country (inapplicable to citizens) and for preventing countraband from entering the country.
A wiped phone cannot contain contraband data, so the border search exemption cannot apply.
In general, there is not. For the border search exemption to allow a warrantless search of a citizen, the only legitimate grounds are preventing countraband from entering the country.
Even Wikipedia spells out that invasive searches require "reasonable suspicion." So we return to the core question... suspicion of what? Suspicion is not a crime. https://en.wikipedia.org/wiki/Border_search_exception
"The government is allowed to use scanning devices and to search personal electronics. Invasive bodily searches, however, require reasonable suspicion." is what the article says
The original text is basically useless. They're more like a mission statement rather than directives. They set up broad aspirations, but the implementation has to be aggregated over literally millions of pages of judicial decisions.
Even lawyers with extremely different ideologies will give you convergent answers in a lot of cases, even when those answers conflict with an apparently obvious reading of the original text. Explaining that would require drilling down into details of thousands of court cases -- like reading a complex proof of a seemingly simple theorem.
I don't like that any more than you do. It's not mathematics, and even when given all the details, I usually find their inferences laughably bad -- even when I agree with the conclusion. It's not "logic" as I apply it as a logician, philosopher, or software developer. Lawyers (people on my side ideologically) will insist on the soundness of reasoning for decisions that they don't like but accept as valid.
So I don't find quoting the Constitution to be of any utility. None of those words what you think they mean. And fixing that requires basically throwing out the entire system of American jurisprudence. Which would be fine with me, to be honest.
And that alone is already a pretty scandalous problem. If the law is not stated in a way that ordinary people can understand, how the hell are they supposed to obey it? Those who cannot afford the highly paid law explainers are basically locked out of society.
I don't think you're entirely wrong, but the Constitution binds the government, not citizens. The government can damn well afford to know what the 4th and 5th Amendments mean.
The words are actually extremely clear and its exceptionally prudent to quote them, because nobody with a brain can read them and fail see that the government is simply being unconstitutional - all over the place. Even when the people are powerless, we dont have to give up our powers of seeing the truth. Your post and this whole idea that "the words dont mean what they say they mean" is frankly doublespeak of the lowest form.
> we dont have to give up our powers of seeing the truth
The truth is that the constitution is interpreted by humans in a common law context, and enforced by the apparatus of state, which has the means to impose its will. Calling this doublespeak is weird.
> None of those words what you think they mean. And fixing that requires basically throwing out the entire system of American jurisprudence. Which would be fine with me, to be honest.
The Constitution is written in plain English. And for the most part, Supreme Court decisions are written in plain English that any reasonably literate US citizen can understand. Yes, the law has technicalities and terms of art just like any other profession.
But one of the most damaging mentalities in modern times is the idea that the common man is incapable of understanding the law at even a basic level. This is flat-out not the case. Which leads to the follow-on problem: people who think lawyers have the ability to cast magic mumbo-jumbo spells that "get their clients off on a technicality" somehow. The best quote I ever heard about that from an attorney was "any time someone says a person 'got off on a technicality,' you can pretty much just safely replace that in your head with 'had their constitutional rights egregiously violated.'"
Yes, there are problems. Qualified immunity is a problem. Prosecutorial misconduct can be a problem. Abuse of discretion at the border is a problem. But that's different from doomerism about the entire justice system to the degree Very Online people express it.
I'm just guessing here, but the most problematic word on the 4th amendment to attack from the government's perspective is "unreasonable". It's easy to see how a phone border search could be construed as reasonable, and (without digging into this deeply) I suspect that's where most of the push back on this will be.
I suspect the 5th amendment is probably more valuable to the defense here as the password is effectively testimonial and the give us your password or we'll ... is compelled speech.
Either way, it's gonna be many 10s of thousands of dollars in lawyers fees to fight this. Which sucks.
> It's easy to see how a phone border search could be construed as reasonable
I'm curious, is there any case law from the pre digital age regarding people forced to open their briefcase and let the border guard read all their documents at a port of entry?
They didn't get the data from his phone and will likely lose the case against him. They probably wanted data to go after other people and those people were protected against it.
It was likely unnecessary to use the duress PIN/password. He likely would have been better off simply refusing to provide the PIN/password. He could have rebooted or powered off the device before going through but even without that it would have automatically rebooted itself after 18 hours by default, or a lower time if he had configured one.
With a lot more preparation he could have done an encrypted backup, wiped the device and restored it later but that's very inconvenient.
Seems like it would be better to have a truecrypt type of situation, where if you put in a certain pin, then it just logs you into a separate OS with nothing you want to hide.
Obviously have the duress pin if what’s in your phone is worse than the obstruction charges too.
In the truecrypt scenario you’d be using the hidden and encrypted volume only for what you explicitly want to keep hidden and use the other one for your daily life.
So in the article situation, the guy is a protestor and presumably suspects he’s going to be targeted by the police for it. He’d keep that stuff isolated from his usual activity. There’d be no need to generate convincing fake activity.
Certainly more of a hassle than having a PIN that can destroy everything.
Burner phone / clean phone for border crossings seems the more accessible option.
As others have noted, this is standard policy amongst many organisations, some on account of US policies and practices, some on account of other states.
I'd say better would be not trying to pull a fast one on the cops. Rather than trying to sneak past them and local innocuous, just exercise your right to say no.
> Obviously have the duress pin if what’s in your phone is worse than the obstruction charges too.
I would say that if what you have on your phone is worse than a destruction of evidence conviction then you may want to just wipe the phone before you get anywhere near a cop. Playing stupid games with cops most often leads to winning stupid prizes. Keep the interaction simple. "No."
Would it be permissible to wipe your phone before going through customs to get back into the US? If they ask to search your already wiped phone, you aren’t destroying any evidence.
I wouldn't assume that to be the case. It's illegal under federal law to destroy evidence of a crime. Just what the government needs to do to show that you've destroyed evidence of a crime and not just the sexting you did with your girlfriend is a pretty murky area of law, from what I can tell.
I would not present a phone to customs that had clearly just been wiped.
You're speaking nonsense since there was no charge or warrant against him. There was no crime that was committed. People are free to use their phone for f sake. People who reason as poorly as you will lead to all remaining rights being lost.
We were talking about an attacker taking an image of the SSD prior to it being wiped not helping them because information needed to derive the key encryption keys is gone from the secure element. It similarly doesn't help them to do a brute force on a server farm since they're rate limited by the secure element. It only allows 20 attempts and has rapidly increasing delays between those. There's also hardware bound key derivation but that only helps improve the strength of a decent password. The secure element rate limiting makes even a random 6 digit PIN highly insecure unless an attacker can exploit the secure element.
The search is supposed to be lawful without a warrant because you're not really in the US yet per-se, hence if you're not there, how deleting the data can be a felony?
It's a fairly shallow point that ignores how laws work.
The premise that the law doesn't apply because you're not in the country is false. The constitution applies generally everywhere to all Americans, it's just that what's regarded as reasonable differs during a border search. IANAL, so just my lay opinion on this. Just to validate this, it's only because the constitution exists that the border authorities have any legal basis in doing inspections.
It doesn’t matter where he was when he deleted the data. He could be in China, it’s still a crime in the us to destroy evidence wanted by American authorities.
Evidence exists independent of a charge or warrant. The instant they asked for access to the phone, it became evidence. If he had entered the duress code himself before walking up to the agent, he'd be fine. Nerds thinking that technicalities is how the law works is why he's in hot water.
- if you're deemed to be on US soil, constitutional protections (4A) apply; can't be destroying "evidence" unless you're accused of a crime or found to have committed a crime
- if you're deemed _not_ yet on US soil, then how can you be charged with a crime under _US_ law?
4A still doesn't permit you to destroy the evidence. Resist on 4A grounds, destroy the evidence, 4A reasons get overturned - you've got yourself a conviction. US v. Akram Musleh.
in practice you're right, but it's hard to see how that squares with the 4A.
an officer can't stop me on the street and demand to see the contents of my phone -- unless they can show "probable cause" that I was about to commit a crime (based on other evidence), or I'm already named as a suspect or POI in an investigation. So if they ask to see the contents of my phone and I delete it instead (it's a very small bag in this example, Lol) am I obstructing an investigation?
If the investigation was legit, then yes. You should just say no. If you give the phone over to them or delete data on it after they ask to see it, you are destroying evidence. Does not matter whether you are the target of the investigation or not, they think you have evidence, you deleted it.
Just say no to the police and then keep your trap shut. This is especially true for federal agents.
I think you legally are in the US while at an American border crossing - at least if the crossing is on US land, which it was in this case. It might be more complicated for preclearance spots. It's just that normal rights are suspended there despite being in the US, even for citizens. Make of that what you will.
> While the Supreme Court has long recognized a border-search exception to the Fourth Amendment’s warrant requirement, it applies to only two interests: promoting the duty regime and preventing contraband from entering the country; and ensuring that individuals are legally admitted. The government’s recent use of the exception goes substantially beyond these matters.
None of these two interests apply to his targeted search. No duty applies here. By definition, no contraband can exist on an erased phone.
The alleged crime is knowingly interfering with a lawful search (by providing a duress password that deleted the phone). Location has nothing to do with it.
I don't know about you, but don't people use encryption to retain privacy? And are people still free to manage their personal information? Doesn't a duress PIN present that information in its intended form? I'm confused.
I'm not a legal expert, but all this seems to check out with US law. Americans need to remember that some of their constitutional rights don't really apply at ports of entry by design. This inconvenient truth for the land of the free has existed for a long time, this situation is just drawing attention to it. Their powers are far-reaching.
Fun fact, there is a long standing exemption to the unreasonable search and seizure protection laws if you're out on a boat (it may only be on the open ocean and Great Lakes, though IANAL). One of the earliest Supreme Court rulings essentially said that without it, it would be impossible for the US to enforce tariffs, which were the main source of revenue at the time. Anybody who boats often enough has been boarded by the coast guard for various safety checks that allows them to poke around and there's little you can do about it.
Any “navigable waters” fall under this jurisdiction which at a minimum includes all salt water and the Great Lakes, plus a few other odds and ends rivers and so forth. Indeed, almost all state and landside federal law goes out the window on a boat - a frequently bumped into example by boaters here in Washington is getting a civil penalty flavored reminder from USCG that cannabis is still (for whatever reasons) federally an illegal substance, and having it on a boat at all is an offense (with larger amounts or future violations escalating as far as seizure of the vessel).
The US / common law jurisdictions typically only have very light self-incrimination protections. The 5th amendment in the US only protects against self-incriminating testimonial. That's it.
In most other jurisdictions (i.e. civil law) it's perfectly legal for the accused to destroy evidence (assuming you're not committing any other crimes in doing so, like breaking and entering, property crime etc.), seizure being ordered or not, while it remains illegal to destroy evidence at the behest of someone else. I.e. civil law usually doesn't criminalize self-protective conduct. That's true even in e.g. Japan.
Non-US-centric legal topics are surprisingly often a blind spot in enwiki, this is one of them. The civil law core is "nemo tenetur (se ipsum accusare)", the principal reifications are wildly different in the jurisdictions. Here are some examples:
- Japan (South Korea has practically the same law word-for-word): https://www.japaneselawtranslation.go.jp/en/laws/view/3581/e... ("...relating to a criminal case of another person" i.e. this is not applicable if you do it in your own case). Likewise article 103, harboring is not illegal if you're related.
- The usual suspects, Italy, Poland, Austria (of course), Switzerland, ... even the Russian criminal code has pretty much the same provisions
- Also the usual suspects: France ("guilletoine them all") and UK (common law) do not have this
Curiously, China quite closely matches the US.
This is essentially one aspect of Hobbesian self-preservation, I don't believe enwiki even mentions this idea anywhere. Another aspect of self-preservation is that -obviously- the mere act of escaping from prison or evading arrest can't be a criminal offense, and it isn't in most civil law jurisdictions.
But of course in common law jurisdictions, the state requires you to not just aid investigations with the goal of imprisoning yourself, but also help imprison yourself, and then also keep yourself imprisoned. Anything else is another crime against the crown in and of itself.
So the part of this that feels like it triggers the government issue here is that in effect you have a locally stored encryption key which gates access to the device, which was removed from the device due to duress password.
What if we flipped this to instead be something that's explicitly not on the device?
The border search stuff only applies to information on the device. It cannot compel you to provide access to e.g. emails stored in a cloud provider.
If instead of making the process of stopping searches like this be a destructive one, we instead pre-purge the key but store it offsite with the ability to get it from an online location, then this feels like it's probably reasonable here. In the sense that the 4th amendment explicitly allows "The right of the people to be secure in their persons, houses, papers, and effects, ..."
There's probably some sort of technical problem I'm missing here (or maybe this functionality is available already).
> or maybe this functionality is available already
Basically already exists depending on specific trade offs and risk profile.
You already can encrypt your data and store the encryption key offsite. But then you couldn’t use your phone during travel, if you toss the key locally.
You can encrypt the data at rest and leave the decryption key in RAM and just turn off your phone. But they can still take the phone and copy the encrypted data, if they think they’ll get the key later.
My understanding is that this individual would t want the government to access the encrypted data either.
I'm talking specifically about the graphene OS ability for that approach, not the ability to add an external key to some generalized encryption. The threat model here is that the traveler was required to provide a passcode unlocking a key they had with them on their phone. If that threat is not there, then this bypasses problem.
> The border search will include an examination of only the
information that is resident upon the device and accessible through the device's operating system
or through other software, tools, or applications. Officers may not intentionally use the device to
access information that is solely stored remotely. To avoid retrieving or accessing information
stored remotely and not otherwise present on the device, officers will either request that the
traveler disable connectivity to any network ( e.g., by placing the device in airplane mode and
disabling Bluetooth and Wi-Fi connections) or where warranted by national security, law
enforcement, officer safety, or other operational considerations, officers will themselves disable
network connectivity. Officers should also take care to ensure, throughout the course of a border
search, that they do not take actions that would make any changes to the contents of the device.
and
> Passcodes or other means of access obtained during a border inspection will only be
utilized to facilitate the inspection of devices and information subject to border search. Passcodes
or other means of access may not be utilized to access information that is only stored remotely.
Passcodes or other means of access should only be recorded by the officer in a temporary format
and should not be uploaded into CBP systems. Passcodes or other means of access recorded by
the officer will be deleted or destroyed when no longer needed to facilitate the search of a given
device.
That has been the case for a long while. I used to travel a lot for work - Serbia, Czech Republic, Germany, Portugal, Australia, NZ, Qatar, Kuwait, Moldova - but the only unpleasantness I received at a border/intl airport was on landing in the US, twice; NY both times. Talk about rude and aggressive, for no reason at all. I'm from the UK, by the way.
My fondest border experience was many years ago when entering France; this was before the UK had joined the EU. (Our later exit was dumb, IMO.)
Anyhow, a youngish officer - probably mid-20s or so - examined my passport while asking questions, in perfect English. His voice was even and his demeanour calm and professional. Then he took a step back, closed my passport and put it in his pocket. A few seconds later, he started laughing and said: "The look on your face. Priceless. Welcome to Paris."
We can tell OP is using local or unencrypted DNS because they got DNS-redirected to a message.
If you have DoH configured at either OS or browser level then you will not see a message: the site will either work, or it will error out if the IP is blocked.
If you are using an alternative DNS provider over unencrypted DNS then either outcome is possible.
I'm not sure that roaming still works that way. It used to. I think you get configuration from your home network but everyone involved tries to get your traffic onto the internet at the closest opportunity.
It's like those notices "by clicking accept below you agree to giving up your data", by purchasing a ticket to visit US all your data are belong to us.
Why are Republicans always attacking their fellow citizens' freedom? *
This is a direct result of a Republican administration pursuing these restrictions and enabling these people to do these horrible things upon their own populace.
The real question to ask is, why are these American citizens so happy to violate the rights of their fellow americans?
Not sure what way you’re trying to land with this rhetorical question, but the Republicans, right? Biden took office in January 2021, and vaccines began to roll out around April.
The entirety of modern Republican/conservative political is built around attacking or hurting or harming non-white people. Germany had a party with a platform built around similar politics. That German took away their citizens’ freedo. As well. So surprises that American fascists do the same; it might be something shared in common across various forms of populist fascism in general.
It's really just a sign that America has definitively and unequivocally entered it's cultural endgame. Of course American citizens are happy to violate the 'rights' of other Americans; being American in 2026 means absolutely nothing other than being able to tribally pick a side that claims to be the "real Americans" fighting for "what's right". Agents of the state are more than happy to leverage their positions of authority if it means they can grab a small win for their side.
Of course, Snowden gave us definitive proof back in 2013 that 'rights' were being systematically violated for arbitrary purposes. But, no one dares be objective about world events lest they accidentally seed territory to their enemy! "But we can use that for XYZ if we get in!" says the American with glee.
If Americans could be honest with themselves, they would realize national collapse is imminent within a decade. The only path forward is treating those around you with respect such that community is preemptively fostered before it is invariably required for survival.
Pretty hilarious that you have to reach back 25 years for one iffy example that happened right after we had the largest terrorist attack in the history of the earth. It was absolutely a knee-jerk reaction, and wasn't the norm, it's very much the exception.
Please cite something from the last 5 or 10 years. I couldn't find anything to support your claim.
It's absolutely an iffy example, I told you exactly why - you had to reach back a quarter century to find anything, and it was a knee-jerk reaction to a catastrophic terrorist attack. You can't really defend that by saying "canonical". You aren't a serious person if you're citing it here. *Today's Democrats are not the Democrats from 25 years ago after a stinging terrorist attack.*
Asking for an example from the last 10 years isn't moving a goalpost, it's a reasonable thing to ask. I searched and I couldn't find anything that would support your claim.
I mean, why didn't you reach back further before the Southern Strategy. Sure, then I have no doubt that Democrats would fit into your cherry-picking.
Until you provide a recent example, this pointless internet interaction is over.
Americans don’t define freedom the same way I, as a European, might (e.g. having agency, not being broke, not being in prison, not having to fear bankrupting my family if I get sick). They define it simply as not having to give a shit about anyone else. By this definition, they are in fact getting more and more free year after year.
This is on the dot. The entirety of their argument can be summed up as “I don’t want to give a shit about my neighbor”. And, “I don’t want to care for the hungry”. Or, “I don’t want to share medical costs with my neighbors”. Basically, “I don’t want to share anything”.
Americans also want to be able to use the roads for free, eat food and drink water that "somebody" has inspected to make sure it won't kill them, and have fire, police, and EMS show up quickly if they have an emergency.
I'm healthier than my neighbors. I carry 4-6 gallons of water a mile every couple of days on foot. I don't own a car either, I ride a bicycle. If my neighbors and I share medical costs, I'm definitely losing a lot there. My neighbors are obese. 40% of Americans are obese. 80% are overweight. Americans are not healthy in general. They don't even try. How is forcing me to participate in their healthcare a freedom?
The American healthcare system is fundamentally broken on top of this. How is forcing me to pay into a system that is broken and a system I won't use, how is that freedom? Americans spend more money than any other country only to recieve worse outcomes. You can walk into an American hospital, tell them you have just returned from west Africa where there is an Ebola outbreak, and tell the nurse you have Ebola symptoms, and that nurse will send you home with a perscription for antibiotics that don't work against viral infections at all. And then you die. I'm citing a real example that actually happened.
Given the state of American healthcare, I wouldn't go to an American hospital even if near death. I'd try to get myself to a hospital in some other country before going to an American one.
Wide spread obesity is a much a medical problem as a corruption problem.
"One of the most significant challenges in combating the rise of sugary drink consumption in Latin America is the lack of stringent regulations on advertising and the availability of these products. While some countries have introduced taxes on sugary beverages and implemented labeling regulations, these measures are often met with strong opposition from the beverage industry. The industry’s lobbying efforts have been effective in delaying or diluting such policies, leaving many children vulnerable to the adverse health effects of excessive sugar consumption."
It seems normal for the target of forced resource extraction to not even view it as sharing, or see it in a positive light. Helping your neighbor when in need is one thing, being coerced into funding whatever some distant bureaucrat wants is another.
This take is great, because it's nearly always made by someone who drives a giant truck on public roads, from a far-flung exurb that requires all it's infrastructure to be heavily subsidized, to drop their kid off at the school that gets federal/state funding because there's not enough property tax to keep it afloat. He'll also pass a few state troopers on his way, as his town doesn't pay for any local police. Maybe a FD ambulance/truck as well, on it's way from the nearest larger city, to narcan his neighbor.
As another American, you understand that reasonable taxes applied in a progressive manner (with those who have benefitted more from society paying more) are what allow individuals to enjoy the freedoms that you want, right? Because if we don't all pay in according to how much we have, then you're free to make your own decisions until all of the people below you rise up and take back what they have been denied. If you don't believe me, look at essentially any part of history.
It's actually the opposite of racist, because the vast majority of immigrants to the United States are PoC who actively want to embrace that mindset. It shows that greed and gluttony transcend ethnic identity. The American dream is now the wet dream of being able to look down on others because you were smart enough to get yours first, and you can now comfortably watch other people suffer more than you.
When you think about it, non-European migration into the United States actually does strengthen their national identity, because the core identity of America is trying to horde as much as you can and interact with your community as little as possible. It's a match made in heaven!
Considering Americans gave an estimated $617B to charity in 2025, and ranked #6 in the world in the CAF 2024 World Giving Index (ahead of any European country), I would have to disagree that Americans define freedom as "not having to give a shit about anyone else".
The US doesn’t protect positive rights (requiring the government to give you something) in the same way as Europeans.
But this case is pretty clearly about negative rights (preventing the government from doing something) which based on the original Bill of Rights is pretty clear.
> The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
This is a bit worse than that. They're specifically targeting this guy because they don't like his politics, an act that is unconstitutional, but Trump and his administration has had contempt for the constitution since day one.
Republicans might as well rename their party the Democratic Fascists of America at this point.
> Republicans might as well rename their party the Democratic Fascists of America at this point.
I'm reading Stefan Zweig right now, he was a prolific Jewish author from 1890s until his suicide in 1942, living as an exiled Jew from Austria in South America. He has written many words, over a century ago, that would support your claim.
Most parties are named the opposite of what they do. The effective way to name a party is apparently to name it after a popular ideology. That's why both the Nazis and the Stalinists called themselves Socialists.
i think it's just that the American population is the last bunch who gives a damn about it, and the pockets of resistance still makes the news... the same happens mostly everywhere else, just without much complaints.
e.g. in Hungary the authorities treat it as a felony to possess an equipment that can record video or sound and it's not obvious when looking at it. 2-8 years in prison for mere posession, i.e. even if it's turned off in your backpack. random nonsense that if it can also make phone calls then it doesn't qualify (the above is the law paraphrased).
Since there are zero devices that are released that don’t indicate recording, it doesn’t seem unreasonable to outlaw modification of recording equipment to hide recording.
You know, the same way we would be rightfully outraged if Apple was allowing applications to turn on the web cam without signaling to the user that the camera is engaged.
That’s all aside from the fact that Hungary was run by authoritarian minded people. But just as I think it should be illegal for cameras installed in glasses to work without an indicating light, I don’t see how this recording light situation you are describing is really such a highlight of Orban’s excesses.
I know surveillance is on par in the UK, but is the UK also building and populating massive detention centers where people are kept without due process*? Are they flooding the streets of liberal cities with soldiers*? Killing citizens on the streets of liberal states (Minnesota) out in the open? Has nationalism completely overtaken the government and citizenship? Has the opposition party been completely neutered? Does your leader openly break any laws of their choosing while plundering national coffers?
I'm not sure if surveillance is on a par in the UK anymore. ANPR (police run license plate recognition system that scoops up all plates that pass) was a big point of contention during 90s and 00s, but even that has been superseded by Flock (private collection, no major legal safeguards, AI based constant review rather than human review etc).
Technology is becoming too significant an existential threat to all governments. IMO, this is the "animal lashing out when backed into a corner" stage of their arc. All of the bills are coming due and they're having to answer for them.
Stuff like this incident (plus the whole surveillance gambit) just being a reflex out of fear, desperate to stay in power just a little bit longer. The funny part is, in the lashing out, they're exposing themselves and their true nature to an extent that the old illusions are fading fast. I implore people to never forget: your government is comprised of other citizens who are exactly like you; they're neither special nor omnipotent. They're just collecting a paycheck under a title.
If memory serves, I think this is also suggested in the book The Fourth Turning but don't hold me to that.
So far as I can tell --- and someone challenged me on this recently, saying they'd been in court over a case related to it, so take this with a small grain of salt --- this "too high IQ" thing happened once, in New London CT, and if that's really the only documented case you have to wonder whether it wasn't just New London making an excuse for why they didn't hire someone they just didn't like the vibes of. I can say with assurance that there's no "IQ cap" in cop hiring around here; there's a standardized assessment, and there's no score cap on it.
I wince at the disrespect shown to the profession on message board threads (in part because it feels like a self-fulfilling prophecy, and in part because it's so clear that the people expressing that disrespect would be less happy if they couldn't make these arguments --- i.e., they want policing to be bad), but normal people love police. Our resident beat officer showed up at our block parties and was a minor celebrity.
What I don't understand is if he just didn't give any password, he would have been fine. It's only because he gave him a duress pin that he's in trouble.
So, in both cases the government wouldn't have access to the contents of the phone
Actually no, they are required to allow you to enter the country, but they will make it a hassle, to the point of dehydrating you and/or refusing bathroom access, and confiscate the device in the end and access is through other technical means.
18 months is, by precedent, the limit on contempt for refusal to decrypt[0], but this administration is happy to disregard any precedent that does not agree with them.
> Courts have generally found that compelling individuals to provide their numeric or alphanumeric passcode is potentially testimonial under the Fifth Amendment, as it forces the defendant to reveal “the contents of his own mind.” In Re Grand Jury Subpoena Duces Tecum 670 F.3d at 1345; see also U.S. v. Apple MacPro Computer, 851 F.3d 238 (3d Cir. 2017). It is analogous to compelling production of the combination to a wall safe, which is testimonial, as opposed to surrendering the key to a strongbox, which is not. See Doe v. U.S., 487 U.S. 201, 220 (1988). However, even if a court finds that providing the passcode is “testimonial,” it may still fall under the “foregone conclusion” exception
In short, you can't be compelled to give up the code in a dragnet attempt to find evidence against you (e.g. a boarder guard can't riffle through your text messages to see if you might have done something illegal), but if it's already certain that particular evidence exists on the device as a result of other evidence, they may be able to compel you to give up your passcode.
Note though that the cases where this has come up are very few and far between, and there isn't a super clear overriding precedent to follow.
In general though, the best choice here is to say nothing at all and work with a lawyer to figure out how to proceed.
They might have a way to gain access anyway. That was that case where Apple refused to unlock the iPhone 5C of a San Bernardino shooter suspect, so the FBI paid a hacking firm to unlock it. If there's no known vuln to get into a phone today, I wonder if they'd hold onto it in hopes that one shows up later.
That suspect's iPhone 5C had a weak numeric passcode, so the only defense was hardware security limiting the number of attempts. Someone reverse-engineered that, wasn't a backdoor. I'm not sure how GrapheneOS differs from regular Android or iPhone on hardware security, but seems like it's basically the same. Need a secure passphrase to be truly safe.
I didn't say it was a backdoor. GrapheneOS is the only OS that consistently shows as unhackable on lists of devices vendors can hack for police. Which could make it a honeypot, but anything could be one.
Y'know, makes me wonder why Democrates didn't disband ICE and CBP when they had control over the Congress and the government. I mean, they knew those agencies would be used in precisely this way, yet did nothing anyhow.
U.S. citizens are going to need obtain a burner phone before returning, and load it with the absolute minimum to load boarding passes, etc., perhaps some reading material or a movie to watch on the plane, and be prepared to share full credentials for thing at the border.
(I used to do some travel patterns where taking a certain client laptop wasn’t an option. It was an absolute gigantic pain for the type of work I did, but it was just too risky to have a laptop seized and be expected to input credentials.)
Giving up knowledge (password) is something that is typically scrutinized at the border as well. Had he just handed over the phone and the phone had abilities to self destruct if tampered with (e.g too many incorrect pin entries) -- well the gov's case wouldn't been much harder. If they seized property and accidently destroyed the data, then that's on them.
You are correct, you have to give up the phone but can't be compelled to give up the password, and you'd get it back some indeterminate amount of time later.
It's actually been on the books for a while (decades at least) that customs can search you at the border without a warrant even if you are a citizen.
This case seems to have become a big 'Trump bad' poster child (people are calling the US East Germany in these comments...), but if this exact scenario happened at least in the last two decades (I found an example upholding the searches from 2004) then it would at least be possible to charge them with deleting evidence. Even this probably would have been nothing if he refused to give up his password, not being required to provide a password has been upheld for years. They can seize your phone for some time but I'm unsure on the times they ask and then just let you move on when they find out your a citizen.
This is precisely why you should use a pin and not biometrics. You CAN be forced to use biometrics (“something you have”), but NOT a password (“something you know”)
I think it's enough to shut down you phone. Then it needs a pin, and you're entitled to not give that over, I believe. So you should be safe, apart from some kind of rubber-hose cryptanalysis.
If you don't give a pin, they can seize your devices (Andrew Tate on his 1st visit to Florida said that he refused to give pin and they seized phone and laptop)
They can absolutely keep them. Or they can just "lose" them "accidentally". Who exactly would force them to give them back? Or put another way, who exactly will punish them if they break the law?
Honestly, I think this is still fine for most people. The probability of a border agent asking me to unlock my phone is very, very low. The inconvenience of using a burner phone is high.
If they do take my phone (completely shut down, unlikely they'll be able to break in) and it's gone forever, that sucks, but then I get a new phone, restore from a backup, and move on with my life. Given that the probability of getting to this point is very low, I'm comfortable with the risk.
But sure, if I was at high risk of being detained at the border due to my profession, country of origin, ethnicity, etc., I'd probably look at this differently.
It's not sad, it's always been the case, and just expanding areas that are implementing it. It seems a lot of people here haven't travelled, or especially haven't travelled to 'restrictive' places in the past.
I've been to Russia, China (about ten times,) central Asian -stans, various parts of South America, Africa, etc. My phones and laptops (plural because I travel with >2/ea, and it looks kind of weird,) have never been inspected.
I really only hear these stories when people travel to the US, lol. It's especially sad+funny (darkly comic, say,) that the guy in OP is a US Citizen traveling back to the US.
That seems like a wildly different scenario to me. The OP is about a guy who has not committed any crimes. Andrew Tate is a known predator and CSAM peddler, with an active warrant in several countries.
With Graphene that's to be considered reasonably safe if your PIN is unguessable. The wrong PIN delay is enforced by TPM and they don't (yet) have anything other than brute force.
> So you should be safe, apart from some kind of rubber-hose cryptanalysis.
There are vendors that sell the technology to adversarially access phone data, the "Before First Unlock" is the safest state a phone can be, but it's not infallible. The safest option is to have a burner or factory-reset phone with nothing on it, even if the hack succeeds.
I've worked with Cellebrite, the industry standard in IT forensics for unlocking and imaging phones. It just runs a series of known exploits. PIN lock, data encryption and regular updates will beat it most of the time.
When I interact with the general public, I get a nice reminder that most people don't do a decent PIN lock, don't have encryption on unless it's the default for that platform, and don't do regular updates. Lots of reasons why (phone is out of space to do an update; not signed in properly to Apple / Google account; kids use their phone so they want an easy to remember PIN on it, etc. etc.)
Before First Unlock with recent hardware and an up to date OS is probably sufficiently infallible for an average person. I wouldn't want to rely on it if I was engaged in espionage, but for someone who won't get the NSA pulled into the case, I'd be pretty confident. This leaked Cellebrite support matrix shows that BFU was secure against them for iPhones that were nearly four years old at the time, and I doubt it's become significantly worse since then: https://ia800405.us.archive.org/32/items/inseyets-offline-uf...
A compromise to this is that many phones have a "lockdown" mode, where it isn't fully off but refuses to accept biometrics until a code/pattern is used to bring it to a more day-to-day mode.
It's less-secure than being fully off, but it also means if you do need to access your phone you can do so more-quickly.
leave electronics at home. never take electronics to any airport unless you don't care if everything is read. your only option now.
or have a good enough decoy or encryption system in place. Such as pressing a button to lock or replace key documents but keep the rest intact. So what looks like a sensitive document omits key information but still appears to be legit to observer.
I wouldn't really want to deal with the suspicions of having a freshly-wiped phone, or the suspicions of having no phone at all.
A proper burner phone has basic usage on it. Link it to a Gmail account you don't use for anything else so you can have your ridesharing apps on it. Just enough for travel purposes, but nothing else.
If you really have to, have some social media accounts on it too and give them a basic amount of usage. Snap photos of the country you went on the trip to, etc.
I’ve been asked to hand over my phone when I entered India as a visitor with a valid visa. Yes it was a burner phone. Yes the officer questioned me after seeing only 7 photos in the entire Photos app. It was very obvious that it was a burner phone.
Yep, travelling outside your country of origin, expect that your phone/laptop/ect is subject to search. Anything on you is, it's literally stated. Want to push against that? Sure, makes sense, but just carry a burner phone/device and not worry about it. Literally what the US government recommends when traveling to places like China.
Like every citizen is a Jason Born, or Richard Kimble, what an assumption.
The tactic/behavior is atrocious, but the vast majority of people’s phones contain absolutely nothing of interest to anyone. Mindless content and games and mundane text and emails. Even banking info, oh they bough some burritos and Cheerios and corn and gas and Cheetos
I might have had the same thought as you when I was in my early 20s, for reasons I won’t divulge.
In any case, the guy will walk with the good lawyers he’s undoubtedly able to obtain after this exposure.
While Americans deserve better (and more clearly articulated) protections, this is a retarded take. The U.S. does an EXCELLENT job protecting the rights of citizens and non-citizens, even at the border, relative to other countries in the world.
The British (until recently a civilized people) will throw you in jail for refusing to unlock. Or for a tweet the powers that be don't like. Not to mention China, India, Russia...
A very strong immune response, like the one we see in this topic, is exactly what the Americans need to preserve their robust understanding of and de facto access to their rights. But let's not pretend they're doing a bad job. They're doing a great job, and they could be doing better.
For exactly the border search scenario, I wish smartphones could be imaged and restored as easily as PCs. Imagine booting the phone from a flash drive, making an encrypted image of the phone on said drive, and writing a fresh OS before reaching the border.
There's no deception required to protect sensitive data or avoid the seizure of an expensive phone. Consent to unlocking the phone, refuse to unlock the drive. The drive gets seized and you go on your way (if you're a US citizen entering the USA).
Some time ago, Android with a custom recovery could come close to that, but it was fussy and as far as I know, no longer viable. Increased use of TPMs for storing credentials seems to be at least one of the reasons.
Apple makes this very easy. I broke an iPhone and bought a replacement. If you have iCloud, you login to the new phone and you can see which backups you can recover from. If you are transferring a phone, say you upgraded, it’s even easier. You can also image the phone with a connected laptop and store it on a backup drive, which is nice to not use up iCloud limits.
The transfer and backup system are pretty much the same mechanisms.
Restoring is probably order of ~1 hour to go through all the setup. Then some hours to sync any data and updates that need to be redownloaded, apps reinstalled, etc.
That's mostly time for data sync in the background. It takes 5-10 minutes tops to have the phone working again, but longer to get all of the media and other data restored. Depends on how good your connection is.
I've restored iPhones before, and it does seem pretty simple. Easier than PCs for sure. It's not instant, but the basic configuration is restored pretty quickly while the bulk data restoration happens in the background while you're able to use the phone.
Depends on the app and security setup. If it's using old school Symantec VIP Access, it will not survive a restore. If it is using TOTP from 1Password, it will. Not sure about other options, those are the two I am most familiar with. Thankfully I only have a single app these days relying on VIP Access.
My banking app required to log again to the bank account to bind new device and that's it. iOS is way better in this regard than stock Android. You pretty much get 1:1 copy on new device in an instant with the exceptions such as banking apps but that's kinda understandable.
It is that simple for most people. Millions of people do this every time they buy a new iPhone and in practice it means waiting a bit while things download and logging into their banking app.
It’s harder for people who don’t use cloud services and have to do things like copy TOTP seeds, but in this scenario you want those to live on a Yubikey with a PIN anyway.
Think for a moment. What is the difference between giving them a password which wipes the phone and giving them a password which opens a blank phone?
It's the same thing. They punched in a code, they are presented with a wiped phone. Can they prove the guy gave them a distress password and wasn't simply carrying a wiped phone to begin with? No, but they just need to imply that is the reason to charge him with the felony.
Best you can get away with is lack of suspicion. Have a secondary phone with some standard apps on that you use now and then so theyhave a history and just look like you are just not a technical person and read novels on dead trees instead. A lot of work but likely works.
We are already there. Border cops have been searching people's socials to see what you think of Trump and denying entry if you don't like him or if you don't have enough socials or don't let the cops search them. This was a year ago.
>What is the difference between giving them a password which wipes the phone and giving them a password which opens a blank phone?
They don't get any indication that there was data there to be deleted, and you don't just factory reset but flash w an image of a clean phone that's been used. It has apps, it has accounts, it looks to the untrained eye (because that's who's looking at it) like a phone that was used normally by someone who has done nothing wrong.
The best technical solution is one code opens to a phone that has things but isn't your actual phone, and then another code that opens to your real phone.
> What is the difference between giving them a password which wipes the phone and giving them a password which opens a blank phone?
> It's the same thing. They punched in a code, they are presented with a wiped phone.
No, the behavior between the two is in fact visibly and obviously different.
The regular passcode unlocks the phone. The duress passcode reboots the phone and resets it. I know this because this is literally what previous articles said happened when they entered the passcode in regards to this case.
You can say it was a wiped phone to begin with, and that may work in court. They're welcome to have evidence it wasn't true, but whether they actually have that evidence is up in question.
But it's irrelevant in this case because the guy confessed.
They could be indistinguishable in theory, but looking up some videos of the process, it appears that GrapheneOS doesn't try to make the duress pin process look like your phone was just blank the whole time. It says "wrong pin" and then the whole thing resets.
The actual difference in this case is that the victim told the cops that the code had wiped the phone. That's a confession. Visible differences aren't relevant.
I mean, you could ship your real phone to w/e destination ahead of you and bring a $50 burner to the border. If you're a person of interest this won't work because they can monitor you and the destination but if you're a regular schmuck then a burner that never touches your private data or accounts and has a bunch of dummy stuff on it will get you past the border goons.
GrapheneOS has built-in encrypted backup and restore. It backs up the same data transferred by Google's device transfer feature for moving to a new phone which is nearly all app data, the data in the home directory, contacts and a bit more. Certain apps such as Signal encrypt their own data with another layer of encryption using a hardware keystore key. Signal's own backup system needs to be used for that, although it can just be used as a way to get data into the system backup.
It's worth noting wiping a device shortly before an anticipated search could also be considered destruction of evidence.
> There's no deception required to protect sensitive data or avoid the seizure of an expensive phone. Consent to unlocking the phone, refuse to unlock the drive. The drive gets seized and you go on your way (if you're a US citizen entering the USA).
This was likely the best move for him to take. They could have held him for a while and wasted his time but eventually would have had to give him access to a lawyer and let him go. Unless they had a recording of him entering a PIN/password, they were nearly certainly not going to get his data from it. He very likely didn't gain anything from wiping it.
He did help every GrapheneOS user by spreading awareness of the duress PIN/password. It was designed around an adversary aware of it and therefore not wanting to attempt using a PIN/password obtained via coercion. In the future, we want to integrate the feature into the secure element rate limiting for key derivation so it can't be avoided by exploiting the OS.
> He did help every GrapheneOS user by spreading awareness of the duress PIN/password. It was designed around an adversary aware of it and therefore not wanting to attempt using a PIN/password obtained via coercion.
You added it by copying Blackberry[1]? But seriously how did you think of that feature?
> GrapheneOS has built-in encrypted backup and restore.
The backup tool on GrapheneOS doesn't work for a large percentage of app data. And it often silently fails to backup some data, so you don't even know where the gaps are.
There have been promises of a better solution for years, but I haven't seen any movement yet.
This has gotten much better fairly recently ime. My backups to WebDAV work most of the time and when it fails I get notifications. But it was quite bad for a long time so I sympathize with your point
> It's worth noting wiping a device shortly before an anticipated search could also be considered destruction of evidence in the same way.
Look, if we are talking about a warranted search in the US then I'd agree with you. However, the entire point of CPB's unwarranted search authority is to stop contraband from coming in.
This would be like arguing that throwing away materials illegal in the US before boarding a plane is destruction of evidence.
Like, even if we assume exactly what CBP's claim is true, it was to stop CSAM. And the person had in fact had CSAM. Destroying the CSAM before getting to the US would be legal even though the US doesn't like it.
Further, if the data is actually backed up, then you haven't actually destroyed it and CBP or another agency can provide you with a search warrant for what they are looking for. But I'd note that this is far outside of CBP's authority. They are for stopping contraband, not FBI work.
And this is why he isn't being charged with destruction of evidence. He is being charged with destruction of property subject to a civil seizure.
The only reason they can charge him with this is that he destroyed it after being notified that it was being seized. If he has deleted it before then there would be nothing they could charge him with.
Right, but I think what makes this interesting is the destruction happened only after violating his civil rights. Had they simply seized the device the data wouldn't have been destroyed. He refused to give them the pass code several times before giving them the wiping code. He asked to leave and see a lawyer multiple times, which they refused to provide him with one. They held him, illegally, until he gave them his phone pass code.
And the whole reason they wanted in his phone (the real reason) was to figure out who he worked with in the stop cop city protest. That's why he was really targeted in the first place.
> I wish smartphones could be imaged and restored as easily as PCs. Imagine booting the phone from a flash drive, making an encrypted image of the phone on said drive, and writing a fresh OS before reaching the border.
Backing up and restoring an iPhone is extremely easy. You don't need to imagine all of this flash drive or encrypted imaging stuff. You plug it into your computer and do a backup. You can then wipe the phone through the menus. Restoring from the same computer is easy.
Except apps themselves don't get backed up, only their data. So if you had any apps that are no longer in the app store or that came from outside of it (e.g. TestFlight or development builds), those won't be restored.
I already refuse to comply with questioning at the border. Been being harassed and my non-citizen travel companions being SA’d by CBP for decades. Get with the program.
PinePhone will boot off a microSD before the internal flash, so you could have a clean OS on the card and your real one on the flash. The SD card is under the back cover with the battery and SIM, so chances are they won't think to try to remove it.
Somebody who doesn't know what they are doing, sure. Somebody who does, and maybe even enjoy doing it, and the challenge of it, will surely know about it simply because they are maybe two dozens of types of smartphones out there. Android (including of course GrapheneOS) based ones, iOS ... then PinePhones, Volla, Purism and few others. So having a guide on how each one can have hidden partitions or booting mechanisms is tractable.
Point being that relying on a hidden trick (rather than encryption) is a very risky bet.
Those "nandroid" backups weren't "close" to that, they were literally that initially. Then, when Android phones started coming with the /sdcard partition mapped to the internal flash memory instead of an actual SD card, the /data partition backup mechanism was changed to copy individual files into some sort of archive, but the end result remained the same.
You can still do it on modern Android devices, as long as the bootloader is unlocked. Yes, the file system is encrypted, but a modern custom recovery is able decrypt and mount it.
Xiaomi has fake unlock. It has an unlock button that never works and never has worked. Instead you have to write a letter to get their approval code or some complete bullshit like that. Of course this is because unlocking is illegal in China and they sell a lot of phones in China.
Not by default, but you have to enable it in developer settings, and then it does a full wipe, so if you plan to root your phone anyway, you do that when you buy it (buy, test hardware, oem unlock + factory reset, root, actually start using).
You have to ask yourself why this isn't possible anymore. Similar to how recording calls used to be possible but no longer. I don't know why it is but it is awfully strange that they keep tightening the belt on what we can do with our own devices.
You can do it on iOS officially. Android never had an official backup process, it was always through root apps. Backups could just be a casualty of killing rooted Android.
Why would recording calls not be possible anymore? On a rooted phone you can do it, some amixer and arecords might be needed, but it stores the audio of both sides.
I really really want this for GrapheneOS. The current backup situation is terrible and nowhere near being able to easily image and restore the entire phone (or at least user data).
Well it’s really easy to do that with an iPhone. Just with the inconvenience of needing to use a computer for that. You can just create an encrypted backup of an iPhone and store that anywhere.
At the border you have the same right to refuse to provide the pin/password on boot of your otherwise encrypted phone as you do to refuse to provide the key for an encrypted USB. (That right differs slightly depending on whether you are a US citizen or not).
What the subject in question of this new story did was cause the border official to inadvertently destroy the evidence on the phone and therefore indirectly destroyed the evidence himself.
(I'm not making a commentary as to whether or not it's a valid charge and criticism, or not. I'm just saying that's the material difference between your scenario and the original scenario)
So, how easy is this today on computers? If I have an Ubuntu 26.04 machine running, I can easily image the entire thing, completely wipe the machine, then reinstall from a flash drive and it behaves as if nothing happened?
This isn’t my territory, so excuse my ignorance, but I’d love to know how
Just get a larger drive than the internal one, and "dd" (copy byte by byte) the whole internal drive into a file on that external drive.
There could be issues with the TPM chips, having to re-enroll fingerprints or something, but not a problem in the case of a border search, since they can't pull out anything. So you could backup your whole system, install a clean ubuntu without anything special on the system (just if they check), and then download the image wherever you are and do whatever you want.
So on a Luks encrypted xubuntu, o can dd to an external and then my laptop can fall in a lake the next day and I run some simple command to unwind that on a fresh laptop and I’m off to the races?
I presume it’s much slower than rsync, since it’s comprehensive each time.
Are there any gotchas?
This sounds too simple to be true—but again, my knowledge on backup is very unprofessional
You can do exactly that, yes, dd whole disk to external drive, dd it back. Of course this assumes you'll be buying the same laptop, otherwise, you'll have to reconfigure stuff, from graphics drivers, resolution etc., resize the partitions (assuming the new hdd is larger, and you can't use a smaller one).
The problem with dd is, that you can't really run it on a running system, because stuff is constantly being written to the drive (this is same for rsync too, but usualy the damage is smaller), so you have to boot a live linux from usb, dd the whole drive to an external drive, and then after swimming ashore, boot a live linux on the new laptop, and dd the backup to the new drive.
They could be, easily so, twrp backup (and clockworkmod recovery before that), you'd just create the image of the phone (all partitions, everything), dump it to wherever, and then restore it, it was a standard system for testing new android versions on the phone.
The "secure enclaves" and other related stuff have made this harder in the recent years.
948 comments
[ 5.8 ms ] story [ 231 ms ] threadOr even
"A soldier stepped on a landmine but since it was his footsteps that triggered the mine he technically killed himself"
Even a duress PIN which triggers predefined deletion of certain folders, messages and apps could reduce law enforcement exposure significantly.
Wiping the overall data on the device via a factory reset, OS recovery mode or duress PIN/password prevents recovering any of the data because it reliably wipes material needed to derive key encryption keys and also reliably wipes the encrypted disk encryption keys. Wiping the encrypted disk encryption keys alone would not be good enough because they're stored on the SSD so imaging the SSD and restoring it could preserve the ability to recover the data. The way the key material needed to derive the key encryption keys is wiped prevents recovery via imaging the SSD mainly due to the secure element.
There's already support for reliably wiping data at the granularity of Private Spaces and secondary users. Those have their own encryption keys and can be reliably deleted due to having their own Weaver slots in the secure element and other hardware-based security integration.
Apps can also assorted generate encryption keys in the secure element and use those to encrypt data where it can be reliably deleted via wiping the hardware keystore keys. That requires apps built to have granular storage and encryption of their data.
Despite it being possible to wipe a secondary user or Private Space reliably, the past existence of it and when it was wiped will be easily discoverable via the main Owner user and system data. Preventing discovery of those profiles having existed requires an overall wipe of the data. It isn't feasible to hide it without doing that and hiding it would involve a whole bunch of unreliable removal of data without a way to prevent recovery along with redoing a bunch of statistics and other metadata to hide that there was another profile until recently. For example, things like the battery and data usage stats directly refer to the profiles. Even hiding it from naive analysis not looking at the leftover data on storage would still require changing a bunch of things to hide it.
Making data deletion of the data reliable for a whole profile or the whole data partition also requires a reboot or shutdown. Consider how much data gets loaded into the page cache and many other forms of data in the Linux kernel and other processes. Consider how much linger around in various kinds of registers, etc. including outside of the OS itself. Reboot or shutdown has code to get rid of this and the device sitting there turned off or booting again also gets rid of it.
They were clearly going to hook his phone up to forensics software on a laptop and had done what they needed to do in order to justify it for their own policies. It would not make sense to set up everything they did simply to have someone non-technical manually sift through his apps. They have widespread access to forensic software and also more advanced software with exploits. They definitely have easy access to it at a major Atlanta airport. The adversary in this case is not a non-technical human but rather advanced software from Cellebrite who are fully aware of alternative operating systems and document information on it. Their documentation directly refers to GrapheneOS and has tables listing their (currently very limited) capabilities against it.
This story got widespread news coverage and is widely known about. That should help make it clear how important it is for features to work against adversaries aware of these kinds of features. Our duress PIN/password works against adversaries aware of it. If they don't coerce a PIN/password from someone or don't enter a coerced PIN/password because they know it could be in use then the feature has worked. We want to improve the feature with secure element rate limi...
I mean - yes? If you design a subtle duress pin that only hides certain things, users would have to choose what.
I myself want the bank apps, password manager and email to disappear without a trace, but I don’t care about the social media, photos or web browser history. Other people, though, will have different priorities.
That's not what we were talking about. This is the full sentence we wrote:
"Reliable deletion of data requires setting it up to be reliably deleted later on by having it encrypted on storage with keys which can be reliably prevented from ever being obtained again."
What we're saying is that in order to have fine-grained deletion of data, it has to be encrypted with fine-grained keys with hardware support for deleting those keys reliably. Reliable deletion of data should also not be confused with stealthy deletion of data which is not generally possible for the kinds of data being discussed.
> I myself want the bank apps, password manager and email to disappear without a trace
You can put all of this into a Private Space or secondary user where it can be reliably deleted as a whole. There will be no way to recover any of the data if the profile is deleted. We have a planned feature for either a toggle to make the duress PIN/password only delete specific secondary profiles or more likely a 2nd duress PIN/password with that different purpose.
Deleting secondary profiles will reliably prevent recovering any of their data, at least after a reboot or shutdown. The best way to do it would be deleting them and then rebooting where the main user and secondary profiles not included in the deletion would still be there after the reboot. Without the reboot, it's unrealistic to reach the point where it's truly highly reliable. The OS does purge the keys for a secondary profile but a lot lingers around in system processes, page cache and elsewhere. If you delete a secondary profile with the goal of preventing data recovery then it's a good idea to reboot afterwards.
Dividing things up into secondary users is the way people can set up having fine-grained reliable deletion of the data. We can expand our duress PIN/password feature to support working with that.
It should be noted nothing about wiping secondary profiles is stealthy. It's very obvious there were profiles and that they were wiped. It can be determined when it happened and approximately how much data was deleted too. The data and filenames are unrecoverable but a fair bit of metadata on the sizes of files, etc. can be recoverable because that metadata is globally encrypted rather than per-profile encrypted. If you want to delete absolutely all traces of it in a reliable way, an overall wipe of the device does it extremely well. If you delete a profile then nothing encrypted by it can be recovered but what about all the evidence of it existing in the system and Owner user data? It's in the battery statistics, data usage statistics, package manager metadata and many other places. It can be purged from those but absence of data can be detected, and there's the usual problem of simply not being able to reliably delete data from computers in a fine-grained way. It's too late to reliably delete data from a file after the file has been regularly rewritten and modified.
Deletion needs to happen through deleting the keys used to encrypt all data which was ever stored in the file, so it would have had to be set up with that in advance. To reliably redact data in a file, the file would need a dedicated hardware-backed key with a new one being generated and the old one wiped as part of redacting data. Reliable wiping of a profile or the overall device works because it's all encrypted with filesystem-based full disk encryption using keys which can be reliably deleted. Profiles have fine-grained encryption for filenames and file data.
You cannot retroactively decide you want to reliably delete the data of a specific app and then do it. It's already spread all over the place. You'd need to wipe the whole profile or the whole device if it's not in a secondary profile. The OS would have had to set up a dedicated encryption key for that app's data with hardw...
Hell, I think a setup that doesn't wipe anything, but just drops you into a sanitized, isolated profile for the border agent to look at, would be fine for many users. Certainly you wouldn't want to use this in truly high-stakes situations where it's likely that your device will be confiscated no matter what, and analyzed to death, but for the simple "border agent wants to snoop on my data for a few seconds" case, it's likely sufficient.
(As always, risk analysis can be hard, humans are often bad at it, and not everyone's threat model is the same.)
Have a phone with crappy battery and have it trigger a high processor load to take the battery voltage drop and turn off the phone? (Eg what Apple tried to prevent with the batterygate thing).
So whatever a duress pin does, it has to be subtle enough that anyone looking doesn't link it to the act of entering the pin.
Reliably deleting data at the scale of the whole data partition, a secondary user or a Private Space is fully supported but requires a reboot or shutdown to truly complete it.
After wiping key derivation material needed to obtain the key encryption keys in multiple ways and wiping the encrypted disk encryption keys, the OS can still access the data. It still has data in the page cache, in registers and elsewhere. There are still a bunch of system processes with data tied to what was removed. The OS is still fully functional after the nearly instant wipe of everything needed to recover the data again. It can still access all data other than what's encrypted with hardware keystore keys and not currently decrypted.
The wiping process for the duress PIN/password is completed with a shutdown which tears down everything, zeroes memory and provides at least a small time window where the hardware is powered off too. A reboot would also work and the boot process has explicit zeroing of memory, registers, etc.
We decided to use shutdown for the duress PIN/pasword but a reboot is a valid approach too. Our locked device auto-reboot timer feature we first shipped in 2021 relies on the zeroing done by GrapheneOS for both the process of the OS tearing down and then again during booting to return the device to Before First Unlock state.
> also create a semi plausible artificial profile to hide the deletion event.
It isn't feasible to fool forensic software so it largely wouldn't work against state actors. It nearly certainly wouldn't have helped in this situation in the news. They aren't reliant on a non-technical person sifting through a phone. They'll just hook it up to a laptop and follow the data extraction procedure which involves enabling ADB. The software is aware of GrapheneOS can guide people through dealing with anything different about it. They've had a lot of trouble with extraction via ADB for GrapheneOS since the vulnerabilities they exploit via ADB keep getting patched or blocked it exploit protections but it isn't realistic to block extraction with them having the PIN/password. They could just enable the encrypted backup service in the OS instead and then use CLI tools to extract the data from there with the seed phrase. They don't do that because they want everything rather than only nearly all app data. They also have special code to deal with apps such as Signal with their own layer of data encryption since the data taken from their app data directory is nearly all useless by itself.
There's also quite a difference between wiping and rebooting into a not very plausible environment with decoy data set up by the user in advance compared to not properly wiping and giving access to a decoy profile. Bear in mind the OS can still access nearly all data after the wipe until a reboot. It could make a best effort attempt at purging as much as possible from memory, but the OS is not designed to continue functioning with all of the data disappearing. It can't just wipe all loaded encryption keys without crashing and rebooting anyway. It also has a ton of data still around in caches and elsewhere. We don't want to just do a best effort job cleaning up as much as we can but rather reliably prevent recovering any of the deleted data.
We could definitely add a duress PIN/password which wipes only specific secondary profiles, reboots and has the device still functional with whatever data was in the main user still there. That's a feature we can add, but it's important to note that it will not hide that there was deletion of data. It's easy to detect, and it's not feasible to hide that it happened. Many steps can be taken to make it less obvious, but it will still be easy for software aware of it to detect. Even a massive overhaul designed to perfect it would not address the SSD itself giving away what happened for more advanced anal...
but that's not the point, the point is to not wind up in court by presenting a phone that no long contains evidence but seems plausibly like your phone so doesn't arouse suspicion
Evidence Tampering
https://xkcd.com/1494/
goal: not getting caught
their need: evidence of tampering
> Tunick provided this code to an agent, who entered it on the phone, after which “the screen went blank, flashed several times and the phone appeared to restart.”
A duress code might let me wipe my phone when someone holds a gun to my head and demands I unlock it. Problem is, there’s still someone holding a gun to my head.
The actual solution is cloud backup + re-image after the border.
Why would the bomb squad trust the box owner to help them defuse it? To understand the issue, you have to construct a proper analog.
But if it did, you'd still be on the hook for the bomb, even though technically the LEO set it off through incompetence.
Because the point of an analogy is not to provide an realistic or identical situation. On the contrary, the point of an analogy is to use a different situation in order to illustrate a very narrow similarity and make a point.
If the analogy illustrates and makes that point well, then it succeeds.
Why would the bomb squad be called after the box is unlocked and the contents revealed?
https://en.wikipedia.org/wiki/Obstruction_of_justice_in_the_...
Doesn't seem like it, no. It seems like the search had no legal basis, and so no legal search was hindered.
At this point, people should buy a burner phone when going to/from the US. In that phone only have a couple of phone numbers and that's it.
At this point? This has been standard practice for a while now.
1. Was there a lawful entitlement to the papers? 2. Were the papers protected private property? 3. Were the papers released to the wind intentionally? 4. If intentionally released was it expected that they would disappear or simply fall to the ground?
A couple easy technological analogies: 3. "Sorry, I gave you the wrong code by mistake." 4. "I thought it would go to a private guest mode, not delete everything!"
"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."
Amendment 5:
"..nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation."
When the administrative enforcement bureaucracies want to harass you they'll hit you with some ruinously expensive civil fine BS. No court will give a crap about you until you've exhausted a bunch of appeals, which you of course appeal to the same agency that's trying to screw you. Only after years of that (and invariably legal fees, because you can't go it alone), do you sue them and get to see a real courtroom. But even then, this is a civil matter, not a criminal one, so all your rights have been nerf'd and there's a hundred years of precedent and case law that tilt things in their favor. If you get lucky, they'll settle and you'll only be out a few tens of thousands for the ordeal.
https://yalelawjournal.org/forum/customs-immigration-and-rig...
The only reasons allowed for border searches are ensuring that individuals are legally admitted (inapplicable here because citizens are always legally entitled to enter) and preventing contraband from entering.
A wiped phone can't contain contraband, so wiping the phone serves the same purpose as a search. It's not destroying evidence anymore than throwing away a water bottle before going through TSA is destroying evidence.
While this is the most compelling argument I've seen surrounding this case and this specific context, the initial attempt to enter with the contraband is likely a crime on its own - partial entry has already happened, the acts in question happened on US soil.
Imagine applying the same concept to drugs (and "body is a container" was found unconstitutional long ago, so no need to opine there) - if you're subject to a search and you eat drugs, does that somehow absolve you of the original attempt to smuggle?
There is no requirement that evidence is "contraband".
As other comments have said, the courts aren't autistic. They don't fall for filly semantic games.
but to say that the laws and precedence aren't largely concerned with building some semantic context, and that lawyers don't build chains of reasoning in that framework to prophet their positions is absolute nonsense.
you're positing a world where a judge just rules entirely on feels, and I think most judges would be quite offended by that notion.
Claiming that destroying evidence of a crime proves no crime was committed is the logic of a 1 year old who thinks the world disappears when they close their eyes.
A wiped phone cannot contain contraband data, so the border search exemption cannot apply.
Even lawyers with extremely different ideologies will give you convergent answers in a lot of cases, even when those answers conflict with an apparently obvious reading of the original text. Explaining that would require drilling down into details of thousands of court cases -- like reading a complex proof of a seemingly simple theorem.
I don't like that any more than you do. It's not mathematics, and even when given all the details, I usually find their inferences laughably bad -- even when I agree with the conclusion. It's not "logic" as I apply it as a logician, philosopher, or software developer. Lawyers (people on my side ideologically) will insist on the soundness of reasoning for decisions that they don't like but accept as valid.
So I don't find quoting the Constitution to be of any utility. None of those words what you think they mean. And fixing that requires basically throwing out the entire system of American jurisprudence. Which would be fine with me, to be honest.
And that alone is already a pretty scandalous problem. If the law is not stated in a way that ordinary people can understand, how the hell are they supposed to obey it? Those who cannot afford the highly paid law explainers are basically locked out of society.
The truth is that the constitution is interpreted by humans in a common law context, and enforced by the apparatus of state, which has the means to impose its will. Calling this doublespeak is weird.
I just bought a cheap 1984 to masochistically read again.
The Constitution is written in plain English. And for the most part, Supreme Court decisions are written in plain English that any reasonably literate US citizen can understand. Yes, the law has technicalities and terms of art just like any other profession.
But one of the most damaging mentalities in modern times is the idea that the common man is incapable of understanding the law at even a basic level. This is flat-out not the case. Which leads to the follow-on problem: people who think lawyers have the ability to cast magic mumbo-jumbo spells that "get their clients off on a technicality" somehow. The best quote I ever heard about that from an attorney was "any time someone says a person 'got off on a technicality,' you can pretty much just safely replace that in your head with 'had their constitutional rights egregiously violated.'"
Yes, there are problems. Qualified immunity is a problem. Prosecutorial misconduct can be a problem. Abuse of discretion at the border is a problem. But that's different from doomerism about the entire justice system to the degree Very Online people express it.
And practical implementation of it all, the rights that you can actual force to have are the third thing.
I suspect the 5th amendment is probably more valuable to the defense here as the password is effectively testimonial and the give us your password or we'll ... is compelled speech.
Either way, it's gonna be many 10s of thousands of dollars in lawyers fees to fight this. Which sucks.
I'm curious, is there any case law from the pre digital age regarding people forced to open their briefcase and let the border guard read all their documents at a port of entry?
https://www.youtube.com/watch?v=_2rokxux5cU
It was likely unnecessary to use the duress PIN/password. He likely would have been better off simply refusing to provide the PIN/password. He could have rebooted or powered off the device before going through but even without that it would have automatically rebooted itself after 18 hours by default, or a lower time if he had configured one.
With a lot more preparation he could have done an encrypted backup, wiped the device and restored it later but that's very inconvenient.
Obviously have the duress pin if what’s in your phone is worse than the obstruction charges too.
So in the article situation, the guy is a protestor and presumably suspects he’s going to be targeted by the police for it. He’d keep that stuff isolated from his usual activity. There’d be no need to generate convincing fake activity.
Certainly more of a hassle than having a PIN that can destroy everything.
Burner phone / clean phone for border crossings seems the more accessible option.
As others have noted, this is standard policy amongst many organisations, some on account of US policies and practices, some on account of other states.
> Obviously have the duress pin if what’s in your phone is worse than the obstruction charges too.
I would say that if what you have on your phone is worse than a destruction of evidence conviction then you may want to just wipe the phone before you get anywhere near a cop. Playing stupid games with cops most often leads to winning stupid prizes. Keep the interaction simple. "No."
I would not present a phone to customs that had clearly just been wiped.
OP is talking about just backing up what you need off-phone and then wiping it.
We were talking about an attacker taking an image of the SSD prior to it being wiped not helping them because information needed to derive the key encryption keys is gone from the secure element. It similarly doesn't help them to do a brute force on a server farm since they're rate limited by the secure element. It only allows 20 attempts and has rapidly increasing delays between those. There's also hardware bound key derivation but that only helps improve the strength of a decent password. The secure element rate limiting makes even a random 6 digit PIN highly insecure unless an attacker can exploit the secure element.
(Very much appreciate your active participation here.)
The search is supposed to be lawful without a warrant because you're not really in the US yet per-se, hence if you're not there, how deleting the data can be a felony?
The premise that the law doesn't apply because you're not in the country is false. The constitution applies generally everywhere to all Americans, it's just that what's regarded as reasonable differs during a border search. IANAL, so just my lay opinion on this. Just to validate this, it's only because the constitution exists that the border authorities have any legal basis in doing inspections.
> On or about January 24, 2025, in the Northern District of Georgia...
[1]: https://storage.courtlistener.com/recap/gov.uscourts.gand.35...
- if you're deemed to be on US soil, constitutional protections (4A) apply; can't be destroying "evidence" unless you're accused of a crime or found to have committed a crime
- if you're deemed _not_ yet on US soil, then how can you be charged with a crime under _US_ law?
https://www.congress.gov/crs-product/RS22497
Although obviously not all US laws apply and enforcement is a whole other kettle of fish.
an officer can't stop me on the street and demand to see the contents of my phone -- unless they can show "probable cause" that I was about to commit a crime (based on other evidence), or I'm already named as a suspect or POI in an investigation. So if they ask to see the contents of my phone and I delete it instead (it's a very small bag in this example, Lol) am I obstructing an investigation?
If the investigation was legit, then yes. You should just say no. If you give the phone over to them or delete data on it after they ask to see it, you are destroying evidence. Does not matter whether you are the target of the investigation or not, they think you have evidence, you deleted it.
Just say no to the police and then keep your trap shut. This is especially true for federal agents.
> While the Supreme Court has long recognized a border-search exception to the Fourth Amendment’s warrant requirement, it applies to only two interests: promoting the duty regime and preventing contraband from entering the country; and ensuring that individuals are legally admitted. The government’s recent use of the exception goes substantially beyond these matters.
None of these two interests apply to his targeted search. No duty applies here. By definition, no contraband can exist on an erased phone.
Marine laws are nuts.
In most other jurisdictions (i.e. civil law) it's perfectly legal for the accused to destroy evidence (assuming you're not committing any other crimes in doing so, like breaking and entering, property crime etc.), seizure being ordered or not, while it remains illegal to destroy evidence at the behest of someone else. I.e. civil law usually doesn't criminalize self-protective conduct. That's true even in e.g. Japan.
- Japan (South Korea has practically the same law word-for-word): https://www.japaneselawtranslation.go.jp/en/laws/view/3581/e... ("...relating to a criminal case of another person" i.e. this is not applicable if you do it in your own case). Likewise article 103, harboring is not illegal if you're related.
- Germany: https://www.gesetze-im-internet.de/englisch_stgb/englisch_st... (this also includes harboring and makes it not illegal for family, which is a typical provision in civilized law)
- The usual suspects, Italy, Poland, Austria (of course), Switzerland, ... even the Russian criminal code has pretty much the same provisions
- Also the usual suspects: France ("guilletoine them all") and UK (common law) do not have this
Curiously, China quite closely matches the US.
This is essentially one aspect of Hobbesian self-preservation, I don't believe enwiki even mentions this idea anywhere. Another aspect of self-preservation is that -obviously- the mere act of escaping from prison or evading arrest can't be a criminal offense, and it isn't in most civil law jurisdictions.
But of course in common law jurisdictions, the state requires you to not just aid investigations with the goal of imprisoning yourself, but also help imprison yourself, and then also keep yourself imprisoned. Anything else is another crime against the crown in and of itself.
What if we flipped this to instead be something that's explicitly not on the device?
The border search stuff only applies to information on the device. It cannot compel you to provide access to e.g. emails stored in a cloud provider.
If instead of making the process of stopping searches like this be a destructive one, we instead pre-purge the key but store it offsite with the ability to get it from an online location, then this feels like it's probably reasonable here. In the sense that the 4th amendment explicitly allows "The right of the people to be secure in their persons, houses, papers, and effects, ..."
There's probably some sort of technical problem I'm missing here (or maybe this functionality is available already).
Basically already exists depending on specific trade offs and risk profile.
You already can encrypt your data and store the encryption key offsite. But then you couldn’t use your phone during travel, if you toss the key locally.
You can encrypt the data at rest and leave the decryption key in RAM and just turn off your phone. But they can still take the phone and copy the encrypted data, if they think they’ll get the key later.
My understanding is that this individual would t want the government to access the encrypted data either.
But...
The issue at hand is the "locality" of the encryption header. He merely facilitated its deletion, not the data.
If he had a backup at home, is that still a felony?
What about if he had a backup on a flash drive with him?
What if he never had the header on the phone to begin with and used a detached header on a flash drive?
Are detached headers (a thing you can easily do with LUKS) now de-facto illegal?
This whole thing is making me feel rather uneasy about the bigger picture.
> The border search will include an examination of only the information that is resident upon the device and accessible through the device's operating system or through other software, tools, or applications. Officers may not intentionally use the device to access information that is solely stored remotely. To avoid retrieving or accessing information stored remotely and not otherwise present on the device, officers will either request that the traveler disable connectivity to any network ( e.g., by placing the device in airplane mode and disabling Bluetooth and Wi-Fi connections) or where warranted by national security, law enforcement, officer safety, or other operational considerations, officers will themselves disable network connectivity. Officers should also take care to ensure, throughout the course of a border search, that they do not take actions that would make any changes to the contents of the device.
and
> Passcodes or other means of access obtained during a border inspection will only be utilized to facilitate the inspection of devices and information subject to border search. Passcodes or other means of access may not be utilized to access information that is only stored remotely. Passcodes or other means of access should only be recorded by the officer in a temporary format and should not be uploaded into CBP systems. Passcodes or other means of access recorded by the officer will be deleted or destroyed when no longer needed to facilitate the search of a given device.
My fondest border experience was many years ago when entering France; this was before the UK had joined the EU. (Our later exit was dumb, IMO.)
Anyhow, a youngish officer - probably mid-20s or so - examined my passport while asking questions, in perfect English. His voice was even and his demeanour calm and professional. Then he took a step back, closed my passport and put it in his pocket. A few seconds later, he started laughing and said: "The look on your face. Priceless. Welcome to Paris."
He really had me and I saluted him for that.
"PAGINA INTERDETTA DAL CENTRO NAZIONALE PER IL CONTRASTO DELLA PEDOPORNOGRAFIA ONLINE (C.N.C.P.O.)"
“PAGE BLOCKED BY THE NATIONAL CENTER FOR COMBATING ONLINE CHILD PORNOGRAPHY (C.N.C.P.O.)”
Oh, we live in an interesting age.
If you have DoH configured at either OS or browser level then you will not see a message: the site will either work, or it will error out if the IP is blocked.
If you are using an alternative DNS provider over unencrypted DNS then either outcome is possible.
You are nonetheless talking about the .ph - only that.
https://ooni.org/post/2021-italy-blocks-gutenberg-book-publi...
Use 1.1.1.1 or something else and tell Mrs. Meloni to go suck eggs.
This is a direct result of a Republican administration pursuing these restrictions and enabling these people to do these horrible things upon their own populace.
The real question to ask is, why are these American citizens so happy to violate the rights of their fellow americans?
which party was in power during the height of COVID hysteria?
(I know I'm going to get flagged for this :))
Of course, Snowden gave us definitive proof back in 2013 that 'rights' were being systematically violated for arbitrary purposes. But, no one dares be objective about world events lest they accidentally seed territory to their enemy! "But we can use that for XYZ if we get in!" says the American with glee.
If Americans could be honest with themselves, they would realize national collapse is imminent within a decade. The only path forward is treating those around you with respect such that community is preemptively fostered before it is invariably required for survival.
The current situation is a result of a nearly unanimous Washington consensus regarding this issue. Not one party vs another.
That's nonsense and the voting record proves you wrong.
Please link to any privacy related vote that hurts the public where "both sides" voted for it.
https://www.govtrack.us/congress/votes#category[]=3,1
The senate vote for the patriot act was 98 to 1.
Please cite something from the last 5 or 10 years. I couldn't find anything to support your claim.
The Patriot Act is not an “iffy example”. It is the canonical one, and was subsequently reauthorized in bipartisan votes.
Asking for an example from the last 10 years isn't moving a goalpost, it's a reasonable thing to ask. I searched and I couldn't find anything that would support your claim.
I mean, why didn't you reach back further before the Southern Strategy. Sure, then I have no doubt that Democrats would fit into your cherry-picking.
Until you provide a recent example, this pointless internet interaction is over.
The cognitive dissonance is staggering.
The American healthcare system is fundamentally broken on top of this. How is forcing me to pay into a system that is broken and a system I won't use, how is that freedom? Americans spend more money than any other country only to recieve worse outcomes. You can walk into an American hospital, tell them you have just returned from west Africa where there is an Ebola outbreak, and tell the nurse you have Ebola symptoms, and that nurse will send you home with a perscription for antibiotics that don't work against viral infections at all. And then you die. I'm citing a real example that actually happened.
https://abcnews.com/news/story/ebola-patient-released-texas-...
Given the state of American healthcare, I wouldn't go to an American hospital even if near death. I'd try to get myself to a hospital in some other country before going to an American one.
"One of the most significant challenges in combating the rise of sugary drink consumption in Latin America is the lack of stringent regulations on advertising and the availability of these products. While some countries have introduced taxes on sugary beverages and implemented labeling regulations, these measures are often met with strong opposition from the beverage industry. The industry’s lobbying efforts have been effective in delaying or diluting such policies, leaving many children vulnerable to the adverse health effects of excessive sugar consumption."
https://latinamericanpost.com/science-technology/latin-ameri...
When you think about it, non-European migration into the United States actually does strengthen their national identity, because the core identity of America is trying to horde as much as you can and interact with your community as little as possible. It's a match made in heaven!
But this case is pretty clearly about negative rights (preventing the government from doing something) which based on the original Bill of Rights is pretty clear.
> The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
Republicans might as well rename their party the Democratic Fascists of America at this point.
I'm reading Stefan Zweig right now, he was a prolific Jewish author from 1890s until his suicide in 1942, living as an exiled Jew from Austria in South America. He has written many words, over a century ago, that would support your claim.
e.g. in Hungary the authorities treat it as a felony to possess an equipment that can record video or sound and it's not obvious when looking at it. 2-8 years in prison for mere posession, i.e. even if it's turned off in your backpack. random nonsense that if it can also make phone calls then it doesn't qualify (the above is the law paraphrased).
You know, the same way we would be rightfully outraged if Apple was allowing applications to turn on the web cam without signaling to the user that the camera is engaged.
That’s all aside from the fact that Hungary was run by authoritarian minded people. But just as I think it should be illegal for cameras installed in glasses to work without an indicating light, I don’t see how this recording light situation you are describing is really such a highlight of Orban’s excesses.
UK is same.
*https://www.nbclosangeles.com/news/local/la-family-120-days-...
*https://www.militarytimes.com/news/your-military/2026/08/20/...
Stuff like this incident (plus the whole surveillance gambit) just being a reflex out of fear, desperate to stay in power just a little bit longer. The funny part is, in the lashing out, they're exposing themselves and their true nature to an extent that the old illusions are fading fast. I implore people to never forget: your government is comprised of other citizens who are exactly like you; they're neither special nor omnipotent. They're just collecting a paycheck under a title.
If memory serves, I think this is also suggested in the book The Fourth Turning but don't hold me to that.
I wince at the disrespect shown to the profession on message board threads (in part because it feels like a self-fulfilling prophecy, and in part because it's so clear that the people expressing that disrespect would be less happy if they couldn't make these arguments --- i.e., they want policing to be bad), but normal people love police. Our resident beat officer showed up at our block parties and was a minor celebrity.
So, in both cases the government wouldn't have access to the contents of the phone
[0] https://arstechnica.com/tech-policy/2020/02/man-who-refused-...
> Courts have generally found that compelling individuals to provide their numeric or alphanumeric passcode is potentially testimonial under the Fifth Amendment, as it forces the defendant to reveal “the contents of his own mind.” In Re Grand Jury Subpoena Duces Tecum 670 F.3d at 1345; see also U.S. v. Apple MacPro Computer, 851 F.3d 238 (3d Cir. 2017). It is analogous to compelling production of the combination to a wall safe, which is testimonial, as opposed to surrendering the key to a strongbox, which is not. See Doe v. U.S., 487 U.S. 201, 220 (1988). However, even if a court finds that providing the passcode is “testimonial,” it may still fall under the “foregone conclusion” exception
https://www.nacdl.org/Content/Compelled-Decryption-Primer
In short, you can't be compelled to give up the code in a dragnet attempt to find evidence against you (e.g. a boarder guard can't riffle through your text messages to see if you might have done something illegal), but if it's already certain that particular evidence exists on the device as a result of other evidence, they may be able to compel you to give up your passcode.
Note though that the cases where this has come up are very few and far between, and there isn't a super clear overriding precedent to follow.
In general though, the best choice here is to say nothing at all and work with a lawyer to figure out how to proceed.
And I'm not fixing the typo.
(I used to do some travel patterns where taking a certain client laptop wasn’t an option. It was an absolute gigantic pain for the type of work I did, but it was just too risky to have a laptop seized and be expected to input credentials.)
It's actually been on the books for a while (decades at least) that customs can search you at the border without a warrant even if you are a citizen.
This case seems to have become a big 'Trump bad' poster child (people are calling the US East Germany in these comments...), but if this exact scenario happened at least in the last two decades (I found an example upholding the searches from 2004) then it would at least be possible to charge them with deleting evidence. Even this probably would have been nothing if he refused to give up his password, not being required to provide a password has been upheld for years. They can seize your phone for some time but I'm unsure on the times they ask and then just let you move on when they find out your a citizen.
Now you know you know, so use a pin
Sad that we have to accept this as a risk of international travel, but here we are.
If they do take my phone (completely shut down, unlikely they'll be able to break in) and it's gone forever, that sucks, but then I get a new phone, restore from a backup, and move on with my life. Given that the probability of getting to this point is very low, I'm comfortable with the risk.
But sure, if I was at high risk of being detained at the border due to my profession, country of origin, ethnicity, etc., I'd probably look at this differently.
I really only hear these stories when people travel to the US, lol. It's especially sad+funny (darkly comic, say,) that the guy in OP is a US Citizen traveling back to the US.
You will lose them.
There are vendors that sell the technology to adversarially access phone data, the "Before First Unlock" is the safest state a phone can be, but it's not infallible. The safest option is to have a burner or factory-reset phone with nothing on it, even if the hack succeeds.
Any chance you want to do a public service and publish the latest compatibility matrix?
Just joking, obviously…
A compromise to this is that many phones have a "lockdown" mode, where it isn't fully off but refuses to accept biometrics until a code/pattern is used to bring it to a more day-to-day mode.
It's less-secure than being fully off, but it also means if you do need to access your phone you can do so more-quickly.
or have a good enough decoy or encryption system in place. Such as pressing a button to lock or replace key documents but keep the rest intact. So what looks like a sensitive document omits key information but still appears to be legit to observer.
Then log in with another temp account and use that for border pass etc, and then after border checks log back into your normal account?
A proper burner phone has basic usage on it. Link it to a Gmail account you don't use for anything else so you can have your ridesharing apps on it. Just enough for travel purposes, but nothing else.
If you really have to, have some social media accounts on it too and give them a basic amount of usage. Snap photos of the country you went on the trip to, etc.
The tactic/behavior is atrocious, but the vast majority of people’s phones contain absolutely nothing of interest to anyone. Mindless content and games and mundane text and emails. Even banking info, oh they bough some burritos and Cheerios and corn and gas and Cheetos
I might have had the same thought as you when I was in my early 20s, for reasons I won’t divulge.
In any case, the guy will walk with the good lawyers he’s undoubtedly able to obtain after this exposure.
The British (until recently a civilized people) will throw you in jail for refusing to unlock. Or for a tweet the powers that be don't like. Not to mention China, India, Russia...
A very strong immune response, like the one we see in this topic, is exactly what the Americans need to preserve their robust understanding of and de facto access to their rights. But let's not pretend they're doing a bad job. They're doing a great job, and they could be doing better.
There's no deception required to protect sensitive data or avoid the seizure of an expensive phone. Consent to unlocking the phone, refuse to unlock the drive. The drive gets seized and you go on your way (if you're a US citizen entering the USA).
Some time ago, Android with a custom recovery could come close to that, but it was fussy and as far as I know, no longer viable. Increased use of TPMs for storing credentials seems to be at least one of the reasons.
The transfer and backup system are pretty much the same mechanisms.
Restoring is probably order of ~1 hour to go through all the setup. Then some hours to sync any data and updates that need to be redownloaded, apps reinstalled, etc.
It’s harder for people who don’t use cloud services and have to do things like copy TOTP seeds, but in this scenario you want those to live on a Yubikey with a PIN anyway.
It's the same thing. They punched in a code, they are presented with a wiped phone. Can they prove the guy gave them a distress password and wasn't simply carrying a wiped phone to begin with? No, but they just need to imply that is the reason to charge him with the felony.
It doesn't even care about plausible deniability.
Best you can get away with is lack of suspicion. Have a secondary phone with some standard apps on that you use now and then so theyhave a history and just look like you are just not a technical person and read novels on dead trees instead. A lot of work but likely works.
In other words, the HN crowd.
They don't get any indication that there was data there to be deleted, and you don't just factory reset but flash w an image of a clean phone that's been used. It has apps, it has accounts, it looks to the untrained eye (because that's who's looking at it) like a phone that was used normally by someone who has done nothing wrong.
> It's the same thing. They punched in a code, they are presented with a wiped phone.
No, the behavior between the two is in fact visibly and obviously different.
The regular passcode unlocks the phone. The duress passcode reboots the phone and resets it. I know this because this is literally what previous articles said happened when they entered the passcode in regards to this case.
See for yourself:
https://www.youtube.com/watch?v=jcgnBjHOK2g
But it's irrelevant in this case because the guy confessed.
When you enter the duress code, you get an animation while it resets, and then it reboots to a factory reset state.
It is directly observable which code was entered. You can claim that it was something else, but your claim is easily dismissed as bullshit.
This was exactly what was observed by the officials in this case.
How is this any different than refusing to unlock the phone? It just seems you've added unnecessary extra steps.
It's worth noting wiping a device shortly before an anticipated search could also be considered destruction of evidence.
> There's no deception required to protect sensitive data or avoid the seizure of an expensive phone. Consent to unlocking the phone, refuse to unlock the drive. The drive gets seized and you go on your way (if you're a US citizen entering the USA).
This was likely the best move for him to take. They could have held him for a while and wasted his time but eventually would have had to give him access to a lawyer and let him go. Unless they had a recording of him entering a PIN/password, they were nearly certainly not going to get his data from it. He very likely didn't gain anything from wiping it.
He did help every GrapheneOS user by spreading awareness of the duress PIN/password. It was designed around an adversary aware of it and therefore not wanting to attempt using a PIN/password obtained via coercion. In the future, we want to integrate the feature into the secure element rate limiting for key derivation so it can't be avoided by exploiting the OS.
You added it by copying Blackberry[1]? But seriously how did you think of that feature?
Genius feature when you put it like that.
[1] https://discuss.grapheneos.org/d/40700-grapheneos-protection...
The backup tool on GrapheneOS doesn't work for a large percentage of app data. And it often silently fails to backup some data, so you don't even know where the gaps are.
There have been promises of a better solution for years, but I haven't seen any movement yet.
"My patients survive most of the time and when they don't I get notifications"
Look, if we are talking about a warranted search in the US then I'd agree with you. However, the entire point of CPB's unwarranted search authority is to stop contraband from coming in.
This would be like arguing that throwing away materials illegal in the US before boarding a plane is destruction of evidence.
Like, even if we assume exactly what CBP's claim is true, it was to stop CSAM. And the person had in fact had CSAM. Destroying the CSAM before getting to the US would be legal even though the US doesn't like it.
Further, if the data is actually backed up, then you haven't actually destroyed it and CBP or another agency can provide you with a search warrant for what they are looking for. But I'd note that this is far outside of CBP's authority. They are for stopping contraband, not FBI work.
The only reason they can charge him with this is that he destroyed it after being notified that it was being seized. If he has deleted it before then there would be nothing they could charge him with.
And the whole reason they wanted in his phone (the real reason) was to figure out who he worked with in the stop cop city protest. That's why he was really targeted in the first place.
You're always been able to backup and restore your iPhone to your local Windows PC or a Mac using free first party software from Apple.
… yeah I doubt that nowadays honestly
Backing up and restoring an iPhone is extremely easy. You don't need to imagine all of this flash drive or encrypted imaging stuff. You plug it into your computer and do a backup. You can then wipe the phone through the menus. Restoring from the same computer is easy.
in before those fucking "I hAvE nOtHiNg tO hIdE" twats
CBP: Customs & Border Protection
Point being that relying on a hidden trick (rather than encryption) is a very risky bet.
You can still do it on modern Android devices, as long as the bootloader is unlocked. Yes, the file system is encrypted, but a modern custom recovery is able decrypt and mount it.
- non-US Samsung phones
- Most Sony, HTC, Motorola are unlocked
- Chinese brands like Xiaomi
Not all Pixels are unlocked; carrier-bought US phones are usually OEM locked.
Not by default, but you have to enable it in developer settings, and then it does a full wipe, so if you plan to root your phone anyway, you do that when you buy it (buy, test hardware, oem unlock + factory reset, root, actually start using).
I have my passwords on proton pass with 2fa. I back my pics to private cloud storage. I keep 2fa backup codes in my wallet.
Wiping the phone on a whim is a minor inconvenience. Full image restoration would be neat.
At the border you have the same right to refuse to provide the pin/password on boot of your otherwise encrypted phone as you do to refuse to provide the key for an encrypted USB. (That right differs slightly depending on whether you are a US citizen or not).
What the subject in question of this new story did was cause the border official to inadvertently destroy the evidence on the phone and therefore indirectly destroyed the evidence himself.
(I'm not making a commentary as to whether or not it's a valid charge and criticism, or not. I'm just saying that's the material difference between your scenario and the original scenario)
This isn’t my territory, so excuse my ignorance, but I’d love to know how
There could be issues with the TPM chips, having to re-enroll fingerprints or something, but not a problem in the case of a border search, since they can't pull out anything. So you could backup your whole system, install a clean ubuntu without anything special on the system (just if they check), and then download the image wherever you are and do whatever you want.
So on a Luks encrypted xubuntu, o can dd to an external and then my laptop can fall in a lake the next day and I run some simple command to unwind that on a fresh laptop and I’m off to the races?
I presume it’s much slower than rsync, since it’s comprehensive each time.
Are there any gotchas?
This sounds too simple to be true—but again, my knowledge on backup is very unprofessional
The problem with dd is, that you can't really run it on a running system, because stuff is constantly being written to the drive (this is same for rsync too, but usualy the damage is smaller), so you have to boot a live linux from usb, dd the whole drive to an external drive, and then after swimming ashore, boot a live linux on the new laptop, and dd the backup to the new drive.
The "secure enclaves" and other related stuff have made this harder in the recent years.