▲ 182 points
back
192 comments
The border agents didn't act in good faith, regardless of what they're empowered to do. They wanted the data for one reason and fabricated another to prompt the device search. The data they were interested in pertained to protest activity protected under the constitution but the lie they told was about something criminal. That anything within 100 miles of the border is constitution free tosses that out, I guess, but is extremely problematic on its own.
> That anything within 100 miles of the border is constitution free tosses that out
That's a misconception. Border/immigration agents can operate inside this zone, including making stops with reasonable suspicion or running checkpoints where everyone is stopped with no suspicion. The checkpoints are limited in scope, and do not provide authority for searching electronic devices. Some people, including a couple dissenting supreme court justices do feel the checkpoint part violates the constitution.
That's distinct from the border search exemption, which allows inspection of everyone and everything crossing the border. It only exists when someone is actually crossing the border and does not allow CBP to stop or search people who are not crossing the border.
Having lived near the US border most my life, the way it was explained to me years ago, is that there is a strip of land at the border crossing, where you are in neither country. In this space, you are not privy to any of the protections you would be allowed were you in either the US or Canada. This is where you are taken when you are forced to leave your car. Part of the current controversy is that the US government is trying to treat this literal no man’s land as both international land as as federal land with the disparate charges they are applying.
Fun fact. Lack of parking is not a legitimate reason to attempt to drive past this region. I was once flagged crossing into canada on a day they were interviewing a lot of travelers. I spotted parking in what looked to me like an overflow lot on the other side of a fence, and when I slowly drove that direction sirens blasted and guns were drawn. Nothing gives you clarity like a gun pointed at you.
I'd heard in another article around this, that in this particular situation they had said it was a routine border search. Not even something criminal, just routine procedure. Then that under neath all that they did in fact suspect something criminal and were using the standard stop as a pretext for criminal investigation is the constitutional violation.
Interesting that all that rules don't apply to water. The moment you stepped on a boat, coastal guard can (and do regularly) board it and conduct a search without any reasoning. They don't need any probable causes, warrants, nothing.
Seems like so far it didn't create any problems, so public is ok with that.
The founding fathers would be aghast at what America became. Hard to imagine modern America passing some of those constitutional amendments that older America passed wayyy back.
On the other hand, why care what the American founding fathers thought? There have been two centuries since then of developments in democratic countries that some Americans could choose as a model they like more. And now it's the Chinese century anyway.
Many if not most of the founding fathers owned human beings, and the vast majority of people (94% of the population) weren't allowed to vote because they didn't own property or they happened to be female.
What are you even talking about?
Who cares what the slave owners thought. What you should care about are Americans who support this stuff now.
This should be an interesting case in today’s legal climate
Obviously grafeneOS has no liability. But the owner of the device didn’t take the action to remove the data, the CBP officer entered it. We already have some precedent around being forced to give up your password.
How does that change if you are forced to give up a password that is destructive? What if the password works fine at home and the same password does a wipe based on location? Either way, the user complied, and did not take action to wipe their device.
Intentions matter. If the intent is to trick the officer to enter a PIN code that will destroy potential evidence then it does not matter that you didn't type the PIN code. Your speech is the thing that triggers a series of events that you know will lead to a wipe. Just like you can be charged with destruction of evidence even if you trick someone else to take the action.
If you have a safe in your home and you knowingly wire up a bomb that goes off when a certain lever is pulled then you lie to the police and tell them the way to open the safe is to pull that lever you'd pretty clearly be responsible for the damage done when the bomb goes off.
I don't see why this would be any different.
You put a sticky note with the duress PIN on your phone. When detained, the officer notices a PIN in plain sight on the phone, enters it, and the phone wipes itself. You were never asked for a PIN.
Could you be charged with destruction of evidence?
> Either way, the user complied, and did not take action to wipe their device.
The user claimed to offer a password to access the contents of the device, and instead offered a password that deleted the device. That is false testimony / lying to an investigation, and is almost certainly punishable in itself.
This is possibly the best advertising. GrapheneOS was kind of niche before. But if the US Government hates you then you're on the right track.
On one hand, I love GrapheneOS and see it as a cornerstone of digital privacy software. I have supported the project financially for years.
On the other hand, I'm worried that the publicity will only make explicit targets out of GrapheneOS users, and that you would only be using it "if you have something to hide".
The "agent entered password themselves, therefore they're to blame" seems as good of a logic as "I'm going to start swinging my arms and start walking forward, so if you don't move, it's YOU hitting YOURSELF".
Maybe digital forensics shouldn't be handled by barely highschool graduates at a busy border crossing
That's egregiously disingenuous. Having a password that protects the infiltration/extraction of your intellectual artifacts is in no way akin to assault on someone else.
A duress password isn't a booby trap. Nothing was damaged except for the fragile egos of the man-children who weren't able to bully someone into giving up their wrong-think.
enough metaphors though. Here is what I think probably actually happened, based on the multiple accounts I've read:
"Give us the PIN for your phone"
"I don't want you to search my phone, and I want to talk to my lawyer"
"If you don't comply, you're going to be in a lot of trouble"
"Can I please just go, I don't want to answer questions or be searched"
"If you don't comply we will seize your phone and detain you indefinitely until we can unlock your phone!"
"I want my lawyer."
"Just tell us the PIN and you'll be on your way. Otherwise it's gonna be bad."
"Look if I have no choice my PIN is 1234, but I don't want you searching my phone without my lawyer present."
...
"Hey! We tried to search your phone and the phone wiped itself! You're going to prison for destruction of evidence!"
As a GrapheneOS user and a U.S. citizen that cares about the constitution, I fully support the actions taken by the individual
Seriously. All of these comments talking about the legality are completely missing the point. At most this indicts the current laws, rather than the person who was illegally and immorally surveilled, searched, detained, coerced, and now harassed through the legal system. Anybody standing on a narrow view of "but this is just the law" while we have an outright hostile government that actively hates our individual liberties has wholly lost the plot.
This probably doesn't hold up legally, but it does hold up logically: if the reason a border search exemption exists is to prevent importation of material that is unlawful to import, wiping a storage device also fulfills that purpose.
It would seem that the officer was searching for evidence of a crime, not to prevent importation.
However, did that evidence really exist? And if it did, was it for something else? Perhaps, the guy just worried about something far more mundane being discovered? We shall never know.
Think Schrodinger's password.
Couldn’t GrapheneOS provide a special pin which boots into an “empty”session? Where the user can install some default stuff to not look suspicious?
It is illegal to lie to a police officer in the US. It's better to remain silent than to tell a lie. Giving a false PIN is a lie. And that by itself is a crime.
I'm not taking sides here, I just wanted to make that clear.
And you should understand that they can lie to you. That's OK and legal, but you cannot lie to them.
"defends" is doing quite a bit of flashy work for this headline. "Feature works as advertised, nobody upset" would be a much more practical headline.
Please note that "search" does not mean agent just scrolling through your photos.
In Belarus, such "search" means plugging a USB cable and downloading everything from your phone AND connected clouds (Google Photos, iCloud etc). Then their software (bought for millions of dollars from a foreign security company) compares every single face in your photos/videos with every single face gov has in their database. And you don't have control of the downloaded data.
It's great publicity for GrapheneOS, has probably led to a huge spike in traffic to their website and downloads.
And ongoing publicity as the trial happens.
UBS had a similar capability on their laptops so they facilitate tax evasion for US clients: https://www.cnbc.com/2015/04/30/why-did-the-us-pay-this-form...
Related:
US Government targets Cop City protester over phone operating system
Keep fighting the good fight GrapheneOS!
I was always worried about situation like this. Wiping out the whole device is easy to prove.
When I was designing my secure vault app for iOS[0], my approach was to make one of the “folders” (I call them vaults), to trigger the wipe out without any sign of doing so while retaining the data in the opened vault. It technically only deletes the index and the keys, and obfuscates them by replacing them with random bytes.
I already heard from a person that was forced to open their app but was let go, because they complied.
The Fourth Amendment of the U.S. Constitution is supposed to protect people from random and arbitrary stops and searches. It's a fundamental American right. But in the 100 mile border zone, the federal government has tried to impinge on those basic rights. https://www.aclu.org/know-your-rights/border-zone
Someone who is a lawyer knows any details about the US justice systems precedents with regards to the fifth amendmend (regards to self incrimination) vs obstruction of justice (by destroying evidence) as would be applicable to a duress wipe? Also would the distinction of being (or not) read their miranda rights and placed under arrest in this case make a difference as to the status of any possible obstruction?
If only these phones could have a feature where you can enter a mode to encrypt segments of data with different encryption keys, all able to be unlocked still by one single master encryption key that you could also enter at any time.
Then when in travel, and about to pass a border, you enter that selective mode. You can enter a different password as the proxy to unlock the phone in this bare minimal data mode. The agents can access it, etc but wont have all the data. That data shouldn't even be visible in the OS, and if they try to copy the hard drive they will get encrypted data in the other blocks.
You still legally comply with orders and unlock the phone but the other partitions don't unlock/decrypt unless you specifically unlock them.
These are the relevant GrapheneOS statements:
Duress hidden profiles viability statement:
https://xcancel.com/GrapheneOS/status/2082153517234676150#m
Regular defenses statement:
https://discuss.grapheneos.org/d/40700-grapheneos-protection...
Discussion: https://news.ycombinator.com/item?id=49055169
Next version should wipe the phone while presenting a dummy account so they can't easily tell anything is missing.
And this is why part of my plans for any international travel are to simply have a physical notebook with phone numbers to trusted friends/family and to buy throwaway devices on the other side (phone and chromebook or similar).
TBF, similar mindset if I ever attend defcon, etc. as well.
Unfortunately, these days with how governments want to spy on everything your phone is your biggest vulnerability. Better to travel with a dumb phone than something that will send you to jail. Regardless whether it’s wiped or not, depending on the mood of the officer.
any reason with graphine os to wipe vs power off? Unless you have an easy bfu password doesn't it protect you from multiple password attempts?
yasss
this is a feel good story
they entered the pass themselves, so by their own treasonous logic, they should charge themselves.
hope the crim charges get dismissed, and a civil suit is filed
get paid, donate a chunk
Go Team Graphene!!!!
Imo it is not controversial that intent to destroy evidence is ilegal is most reasonable jurisdictions.
Now, is this what's at stake here? Evidence of what? Surely at some point, clear allegations need to me made for which the content of the phone is evidence for.
There's alot of speculation of what the indicted person was involved in, or motives of the border agents. Or the insinuation that the tooling that allowed the alleged destruction of evidence is (or should be) ilegal or indications of nefarious intent by those who use such tools. This is all BS.
Am I missing something?
No warrent? No data. Easy as.
is it just me or is it about once a decade somebody gets publicised for this and the government *really* throws the book at them.