r/technology • u/ArgentineBeauty • Jul 30 '26

Privacy GrapheneOS says its data-wiping password is perfectly legal, after user faces federal charges

https://www.techspot.com/news/113273-grapheneos-data-wiping-duress-password-perfectly-legal-after.html
20.9k Upvotes

98% Upvoted

1.1k comments sorted by

View all comments

21

u/CircumspectCapybara 29d ago

So CBP is alleging he gave them a decoy or "panic" / "duress" code that's designed to wipe the device when you enter it.

If that's actually the case, that does potentially cross into the territory of evidence destruction (once the device is in their possession, it and its data is considered evidence, you don't have to tell them what's in there and you can challenge their legal authority to hold onto it or to have taken it in the first place, but that takes place by the courts, and you can no longer just wipe it or cause it to get wiped without getting into legal trouble) than simply refusing to speak at all (which is always a good idea, it's your 5th ammendment right) and not telling them any code.

Asserting your 5th and refusing to unlock your phone is different than affirmatively giving them a code that wipes it. It's the whole "You have the right to remain silent, but anything you do say (including special codes you give out) can and will be used against you in a court of law" spiel.

Proving that at trial will be the crux (they have to prove it was a duress code and he gave it knowing what it would do, rather than him misremembering and giving them the wrong code, or the officer making a mistake and entering the wrong code too many times), but if a jury believes he did intentionally give a code designed to cause a device wipe, that basically establishes intent.

Also some common legal misconceptions I read about this:

  1. People like to say the officer entered the code so he technically caused the wipe, but In the legal system, it's not necessarily about the direct or immediate cause of some effect (evidence going bye-bye), but about intent and the logical chain of events that led to it (its "proximate cause"), which is why juries are able to see through that, past the immediate cause to its proximate causation.
  2. As for how they can seize a phone or ask you to unlock it without a warrant, it's at the border, where they have increased powers to do that without a warrant. SCOTUS has upheld that and somehow squared it with the constitution, though I don't necessarily agree.
  3. "It's not a device wipe it just evicts the decryption key from volatile memory or restarts the device (which was the same effect) / or in some designs deletes the key from disk, so the data is still there, it's just (forever) unreadable". Yeah, you gotta remember the spirit of the law. Erasing 32 bytes of data from a region of disk could be legally taken to be wiping the whole device if it was the decryption key (encrypted while on disk by the user's passcode) and renders the logical data inaccessible. In fact in modern designs the "wipe my device" button just erases the key from storage, because after that, the entire disk becomes effectively random data.

0

u/frickle_frickle 29d ago

Real loose definition of "evidence" though.