For non-graphene users (eg. Boring iPhone people like me). So there’s a feature called Duress PIN which as explained through some comments means you put a different pin which intentionally wipes the phone. It’s not auto wipe or wipe after several failed attempts but intentional wipe of device. (Worth explanation as the current title nor the article doesn't easily explain this was made by the US citizen providing the…
It zeroes out the vault where the volume key is stored.
US citizen charged after GrapheneOS phone wipes during airport search
421–430 of 1001 posts
Re: US citizen charged after GrapheneOS phone wipes during airport search
#422Earlier quoted context omitted.
A lot of engineer types forget that the law is not code, and reductionist arguments almost never actually work in practice because it's a human interpreting the law.
It reminds me of tax law in many countries. You can follow the letter of the law, but if the vibes are off, you can still be found to be in breach of a vague catch-all provision (e.g. economic substance doctorine in the US, GAAR in Canada/UK, Part IVA in Australia, etc).
Re: US citizen charged after GrapheneOS phone wipes during airport search
#423Earlier quoted context omitted.
So I guess what you really want is a duress PIN that loads into a fake innocent profile.
Or that just selectively wipes only stuff you have marked for deletion. That way the profile stays up to date and believable.
Of course the problem there is, many people have an app store installed, and app stores have histories. And logs. And "what you used to have installed" is so easily found under Google Play, for example.
As someone else said in this thread, the law isn't code. It's not if-then statement based. It's also predicated upon intent in many cases. What actions did a person take, and why, when told to (for example) unlock their phone.
The problem here is that if you are asked to unlock your phone, any action you take to thwart that request by "trickery" to get data deleted, could be construed as 'deleting evidence'. So while some methods might make it more difficult for the border agent to realise "something happened", if they're suspicious still, then you're still in hot water.
In the eyes of the law, the court, and likely the jury, you've done a sneaky thing to thwart evidence collection.
The only safe method is a full wipe prior to travel. In this manner, you're not deleting evidence when told to hand it over. It's an entirely different bar. They can be cruel about it, and take your phone for a few months, but you're not going to be in legal hot water.
In as no one will see the phone is wiped until you are compelled to unlock it, there's no greater change of the phone being seized. You're already being investigated. Just be blunt, say "Whenever I travel, I just wipe it", and that's that.
This is why it's a shame that GrapheneOS has no viable backup solution. Its build in method is unreliable, and doesn't work very well, and is gitchy, it's a very well known problem.
And Android and ADB sometimes have issues with large backups of directories, and so you have to manage that with tar + stream and other business, but at least working around that is easy.
But if you could backup individual apps and all their data, you could uninstall all your privacy laden stuff, cross the border, and reinstall in minutes.
That's the true, legal way to travel safely. Especially if the app removal resulted in a 'shred' of the data files instead of delete.
If anyone has ever struggled with large data backup/restore, here's the only real method I've found for copying large swaths of files from/to via adb:
adb exec-out 'tar --dereference --create /storage/emulated/0/dir/ 2>/sdcard/backup-errors.txt' |dd of=/tmp/backup-$(date +%Y%m%d).tar && adb shell cat /sdcard/backup-errors.txt
and to restore dd if=backup-20250309.tar | \
adb exec-in 'cd /storage/emulated/0/tempdir; tar xpvf - 2>/sdcard/restore-errors.txt' && \
adb shell cat /sdcard/restore-errors.txt
Or something similar.Re: US citizen charged after GrapheneOS phone wipes during airport search
#424Re: US citizen charged after GrapheneOS phone wipes during airport search
#425Earlier quoted context omitted.
But if the prosecutors can make a convincing argument that your intent was exactly that all along, then you may end up convicted anyway. Intent matters. It might be hard to prove, but it matters. It may not even be that hard; what other possible explanation is there for someone putting a PIN visible on their phone that wipes it while crossing a border?
"it would be funny if the border police typed it in to my phone"
Re: US citizen charged after GrapheneOS phone wipes during airport search
#426Earlier quoted context omitted.
But if the prosecutors can make a convincing argument that your intent was exactly that all along, then you may end up convicted anyway. Intent matters. It might be hard to prove, but it matters. It may not even be that hard; what other possible explanation is there for someone putting a PIN visible on their phone that wipes it while crossing a border?
if the cops do that, they're breaking the law with that search already theyll have a hard time showing that you intended for the government to break the law. first the government would have to admit breaking the law
Re: US citizen charged after GrapheneOS phone wipes during airport search
#427I co-wrote a border search guide for EFF some years ago. I was very interested in finding clever technical approaches but I later ended up feeling that I hadn't given enough thought to the overall threat model questions (even though the guide did address them, perhaps even somewhat usefully). The big picture problem is that the agents performing the searches have an enormous amount of power in terms of potentially se…
> The big picture problem is that the agents performing the searches have an enormous amount of power in terms of potentially seizing devices and potentially denying entry for non-citizens. I think they should not have this power, but the agents and courts probably don't care that I think that. That's the reason I never traveled to the US and never will, just having IT security in your CV is enough to make the border…
Re: US citizen charged after GrapheneOS phone wipes during airport search
#428Earlier quoted context omitted.
So I guess what you really want is a duress PIN that loads into a fake innocent profile.
Yes I thought this was the standard solution? People have been doing this since way back in the TrueCrypt days - IIRC you could configure it to run a whole fake version of Windows if you wanted without easily revealing your actual main volume. Most hardware crypto wallets also have a "duress wallet" feature where you keep a low balance for the same reason. Wiping is obviously extremely suspicious and asking for troub…
It's sad this is the default view. It's his device, his data, his life on that phone. If he had wiped the phone before the interrogation it wouldn't be a problem. How long before? A second before? A week before? But wiping the data a minute later is suddenly asking for trouble.
Re: US citizen charged after GrapheneOS phone wipes during airport search
#429Earlier quoted context omitted.
How about, is there reasonable suspicion that a crime has occurred?
Not required at an airport, for whatever reason.
Re: US citizen charged after GrapheneOS phone wipes during airport search
#430Earlier quoted context omitted.
So I guess what you really want is a duress PIN that loads into a fake innocent profile.
Or that just selectively wipes only stuff you have marked for deletion. That way the profile stays up to date and believable.
The good thing about a total wipe is that it's very easy to implement, and it's hard for it to go wrong. You just encrypt the whole drive and, when you want to wipe it, erase the key.