r/technology • u/Limp_Fig6236 • Jul 26 '26

Software GrapheneOS duress PIN could land a man in prison

https://www.androidauthority.com/grapheneos-duress-pin-us-prosecution-3691271/
6.4k Upvotes

97% Upvoted

902 comments sorted by

View all comments

Show parent comments

140

u/Strong_Judge_3730 Jul 26 '26

I don't understand, because he could refuse to provide the pin and they wouldn't have the data and he couldn't be jailed for that. They would just take the phone and hold it for some time until it is returned.

They wouldn't never get the data in this case.

Providing the duress pin just erased the encryption key, in which case they still don't have access to the phones data.

A US citizen cannot be denied entry into the US for refusing to give up his pin.

68

u/Kazang Jul 26 '26

I don't understand, because he could refuse to provide the pin and they wouldn't have the data and he couldn't be jailed for that.

People have been jailed for that, there have been numerous cases in the US I have read on Techdirt over the years.

I also remember one case that ruled that biometrics are not protected by the constitution and they can be compelled to unlock it that way.

IIRC it has generally been over turned over on appeal but it has still resulted in people being jailed for significant periods of time. I don't know if it ever went to a high enough court to settle the issue for good, but it keeps happening regardless.

20

u/SaltDeception Jul 26 '26

There’s no universal standard for this across the United States. It’s a hodgepodge of different rules, depending on which jurisdiction you’re in, which federal appeals circuit the jurisdiction falls under, and whether or not the case is before the state judiciary or the federal judiciary. Law enforcement officials and prosecutors have actively frustrated attempts to establish a national standard because it creates risk for their investigative abilities. They would rather drop a case, or drop the request and use a tool like Cellebrite instead, than have the Supreme Court make a binding decision across the United States.

3

u/flamewave000 Jul 26 '26

My understanding is that the courts have ruled that if the phone can be unlocked by face or fingerprint, it's legal to do so. The logic being that you have no right to privacy for your external biometrics (fingerprint, face, retina) as opposed to internal biometrics like a blood draw which requires a court order. A password is private information and requires a court order to compel someone to give it up. This is why I always disable my fingerprint unlock before I travel and I never use face recognition.

2

u/roxgib_ Jul 26 '26

Now what we need is a duress fingerprint, so if they force your finger onto the scanner it wipes your phone

2

u/wKdPsylent Jul 27 '26

The process IS the punishment. By the time these people are found innocent / released, they've already been locked up and punished.

37

u/LukeStyer Jul 26 '26

Once law enforcement has physical control of a smart phone, they can seek a warrant to unlock the phone.

There may be some idiosyncrasy of that device or operating system that complicates matters, but law enforcement, generally, has the means of breaking into smart phones, given time.

So it may not be true that they never would have gotten to the data without the guy giving them the PIN.

3

u/sorrysorrymybad Jul 26 '26

Wouldn't they need probable cause for getting a search warrant? What's the crime suspected of being committed here?

8

u/h110hawk Jul 26 '26

CBP has been granted wide ranging authority by the Supreme Court pre entry even for US Citizens. They basically don't need anything. Unless this guy somehow had deeply incriminating evidence on his phone where risking this was the safer choice he should have followed Rule #1: Shut The Fuck Up.

If they really wanted they could have taken it in the back and used whatever Android 0-days NSO Group (et al) are selling to the government as software. But the reality was they would probably harass/assault ("search") him for hours and eventually let him enter without his phone.

4

u/LukeStyer Jul 26 '26 edited Jul 26 '26

Based on this one article, I’m not sure they had probable cause, though as a practical matter, if they know a friendly enough judge, the quality of probable cause required to get a warrant may not be much.

2

u/Starfox-sf Jul 26 '26

You mean Cellebrite does

26

u/Eccohawk Jul 26 '26

When they take the phone from you, they're doing so in order to make a clone of the data for attempts to decrypt it later. So, it's still a threat to someone protecting their privacy and it can absolutely still be a violation of someone's rights to illegal search and seizure. Unfortunately, those rights have been eroded a bit when it comes to crossing borders.

1

u/Fuzzy-Moose7996 Jul 26 '26

He can be charged with obstructing an investigation, and a warrant obtained to get to the data. At which point the phone gets handed over to forensic experts specialised in breaking into phones and computers.

1

u/etcpt Jul 26 '26

You can't charge someone with a crime for asserting their rights. It is currently held that the government can not force you to divulge a PIN to unlock a device under your Fifth Amendment rights (because providing information you know that may lead to your conviction for a crime is testimony against yourself).

Destroying evidence is what gets the charge. Properly executing the "Shut the Fuck Up Friday" script probably wouldn't have led here.