The border agents didn't act in good faith, regardless of what they're empowered to do. They wanted the data for one reason and fabricated another to prompt the device search. The data they were interested in pertained to protest activity protected under the constitution but the lie they told was about something criminal. That anything within 100 miles of the border is constitution free tosses that out, I guess, but is extremely problematic on its own.
> That anything within 100 miles of the border is constitution free tosses that out
That's a misconception. Border/immigration agents can operate inside this zone, including making stops with reasonable suspicion or running checkpoints where everyone is stopped with no suspicion. The checkpoints are limited in scope, and do not provide authority for searching electronic devices. Some people, including a couple dissenting supreme court justices do feel the checkpoint part violates the constitution.
That's distinct from the border search exemption, which allows inspection of everyone and everything crossing the border. It only exists when someone is actually crossing the border and not not allow CBP to stop or search people who are not crossing the border.
Interesting that all that rules don't apply to water. The moment you stepped on a boat, coastal guard can (and do regularly) board it and conduct a search without any reasoning. They don't need any probable causes, warrants, nothing.
Seems like so far it didn't create any problems, so public is ok with that.
Interesting that the distinction between phones and boats was not enough to dissuade whatever point it is that you're trying to make.
From Chief Justice Roberts in Riley v. California: "One of the most notable distinguishing features of modern cell phones is their immense storage capacity. Before cell phones, a search of a person was limited by physical realities and tended as a general matter to constitute only a narrow intrusion on privacy."
The same is true at any border crossing - you have to submit to searches by CBP agents, who don't need any probable cause. I believe device searches are still a somewhat greyer area, at least if password protected (as providing a password would be compelled speech, unlike a luggage search which can be conducted without any action from your part).
The founding fathers would be aghast at what America became. Hard to imagine modern America passing some of those constitutional amendments that older America passed wayyy back.
On the other hand, why care what the American founding fathers thought? There have been two centuries since then of developments in democratic countries that some Americans could choose as a model they like more. And now it's the Chinese century anyway.
This should be an interesting case in today’s legal climate
Obviously grafeneOS has no liability. But the owner of the device didn’t take the action to remove the data, the CBP officer entered it. We already have some precedent around being forced to give up your password.
How does that change if you are forced to give up a password that is destructive? What if the password works fine at home and the same password does a wipe based on location? Either way, the user complied, and did not take action to wipe their device.
Intentions matter. If the intent is to trick the officer to enter a PIN code that will destroy potential evidence then it does not matter that you didn't type the PIN code. Your speech is the thing that triggers a series of events that you know will lead to a wipe. Just like you can be charged with destruction of evidence even if you trick someone else to take the action.
>Your speech is the thing that triggers a series of events that you know will lead to a wipe.
The owner of the phone doesn't know that. They have no control over or insight into the officer's brain to know what they'll do. The officer might suspect the phone-wiping functionality exists and decide not to enter the password. If we start talking about ultimate causes then judicial matters become infinitely complex. What immediately caused the phone being wiped is the wrong password being entered by the officer.
The level of duress also matters. US citizens have been shipped to foreign prisons and there's an active case of high-level officials at DOJ violating court orders about that.
Theoretically yes, but in this case there's approximately zero chance a judge would accept "I destroyed evidence because there's a vague chance ICE might send me to a deportation camp".
That's a bit of a strawman. No defense attorney would omit the other circumstances of the search, some of which very likely overstepped legitimate authority.
while attempting to avoid armchair-law-interpreting because I really do not intend that, and I agree that this is going to be an interesting/deeply-worrying legal case:
wiping the device before carrying it across the border seems essentially identical to me. like, saying "you can't wipe it when searched" would also imply "you can't have an empty device when crossing because it may have been wiped before the search to avoid having your data searched" since people can (and often do) do that for exactly that reason.
that may very well be what they want / what they are trying to legally allow during searches, but it also seems like it'd raise a hell of a lot more outrage. it's essentially claiming all citizens are under full legal hold all the time, if they ever intend to leave the country for any length of time.
To my knowledge, no citizen has ever been prevented from reentry due to a blank or absent device. In fact they cannot block a citizen’s legal reentry for any reason, they can only detain you while they investigate.
Beyond this, “I dropped my phone in the ocean” is always a perfectly valid reason.
If you’re a foreigner and they already suspect you of something, they can deny you entry for any reason. It may be better to be denied than arrested!
> wiping the device before carrying it across the border seems essentially identical to me.
This seems more in line with many companies' email retention policies to delete all mail after some time period. This is to protect the company from anything compromising that might have been said, should an investigation ever occur. Better to just not have any record of anything.
> wiping the device before carrying it across the border seems essentially identical to me.
On the contrary, there is a huge gulf between these. Providing a fake password that wipes a device while under active questioning is a clear case of providing false testimony. Lying to the police while under investigation is simply illegal, regardless of the thing you're lying about.
By contrast, entering the country with a clear device is not a crime under any possible interpretation that I can see. Now, if you are wiping evidence while you know there is an active investigation against you, that may be a crime as well, but it's a completely separate crime and can't be easily judged by an officer that simply finds you with a clean phone.
> Providing a fake password that wipes a device while under active questioning is a clear case of providing false testimony.
False testimony of what? Can you be compelled to provide testimony that allows a police officer access to your private data? Can a police officer demand I log into my online medical chart so they can complete their investigation?
> Lying to the police while under investigation is simply illegal, regardless of the thing you're lying about.
Perhaps for certain definitions of police, investigation, illegal, and lie. But as a blanket statement, not even remotely. Otherwise every person found guilty of any crime they said they didn't commit would also be found guilty of lying to the police officers who interrogated them.
isnt it amazing how we are able to know when something is a trick and clearly caused by your action/intention vs when it isnt? i mean sure we can contrive (or maybe even find example of) some scenario where it might be a hard grey area, but ive always found it so cool how we often operate on "top down" methods like this that logically have no basis for working out but 'common sense' happens to be common enough still
You could still be brought before a jury to determine if you knowingly provided the wrong PIN (and thus knowingly gave false testimony) or not. Records of you intentionally setting two very similar PINs and discussing any such plan could be used to convince a jury that it was malicious.
The 4th ammendemnt is the one that protects your data and other possessions in general, not the 5th. The 5th protects you from being compelled to give testimony that might incriminate you, which then protects you from being compelled to offer a password to access data that could be used to incriminate you.
Since 4th ammendemnt protections are significantly curtailed at border crossings, they can actually declare on the spot that your data is now their data. The only thing they can't do is force you to tell them how to access it - but, if they can hack your password, they actually have the right to search your phone just as much as they have the right to search you luggage.
If you have a safe in your home and you knowingly wire up a bomb that goes off when a certain lever is pulled then you lie to the police and tell them the way to open the safe is to pull that lever you'd pretty clearly be responsible for the damage done when the bomb goes off.
I fully agree but that is a different argument than the one mingus88 presented. They suggested that the owner did not wipe the device because they did not actively enter the pin, which seems to be a flawed idea because legally intent matters.
> Either way, the user complied, and did not take action to wipe their device.
The user claimed to offer a password to access the contents of the device, and instead offered a password that deleted the device. That is false testimony / lying to an investigation, and is almost certainly punishable in itself.
It would depend on precisely what the ask was. Did the officer ask, "Give me the pin to unlock the phone."? In that case the command was complied with.
Even if the prompt was vague like "what's the pin for the phone", you'd be hard pressed to convince a judge that a duress pin (to wipe the phone) is a reasonable person[1] interpretation.
Not really, no. I think it would be extremely hard to convince any jury that you really believed that a PIN that wipes the phone was what the officer was asking for.
On one hand, I love GrapheneOS and see it as a cornerstone of digital privacy software. I have supported the project financially for years.
On the other hand, I'm worried that the publicity will only make explicit targets out of GrapheneOS users, and that you would only be using it "if you have something to hide".
Say that as they may, it’s a whole different slope to fall down if they want to do anything about that beyond pointing and whining. If we cross that bridge, we probably have bigger things to worry about. So I think it should be fine for now.
The "agent entered password themselves, therefore they're to blame" seems as good of a logic as "I'm going to start swinging my arms and start walking forward, so if you don't move, it's YOU hitting YOURSELF".
Should we take the same approach for physical searches? If the cops are executing a search warrant on a house, and there's a safe, should they send in a safe cracker on the off chance the safe is wired with a "duress pin" (eg. thermite that burns the contents)?
I mean, if it's possible to configure and there is at all a reason for someone to configure it as such, then it makes the most sense to treat it as a very valid possibility, right?
Hindsight is 20/20 right? Sure, the duress pin feature was around for years, but so was the technology to set up a thermite boobytrap in a safe. Maybe now CBP officers should be more careful about entering random pins people gave them, but snarky remarks like "Maybe digital forensics shouldn't be handled by barely highschool graduates at a busy border crossing" are entirely unjustified.
That's egregiously disingenuous. Having a password that protects the infiltration/extraction of your intellectual artifacts is in no way akin to assault on someone else.
A duress password isn't a booby trap. Nothing was damaged except for the fragile egos of the man-children who weren't able to bully someone into giving up their wrong-think.
The point isn't that giving a duress pin is the same as physical assault, or that the duress pin feature is a "booby trap". It's that for the purposes of ascertaining guilt, you don't get a pass just because you're not the person that physically initiated the action.
Easily illustrated with the comparison to burning a piece of paper with evidence in front of an officer trying to obtain it. Though even though the “guilt” there is the burner’s, that there is any guilt to assign at all depends on whether the law had jurisdiction to that paper in that situation.
Knowingly obstructing investigations is illegal even if there isn't an active search warrant
>During the fall of Enron, Arthur Andersen, Enron's accounting firm, instructed its employees to destroy documents relating to Enron after Andersen officials learned they would soon be investigated by the Securities and Exchange Commission.
It is illegal to lie to a police officer in the US. It's better to remain silent than to tell a lie. Giving a false PIN is a lie. And that by itself is a crime.
I'm not taking sides here, I just wanted to make that clear.
And you should understand that they can lie to you. That's OK and legal, but you cannot lie to them.
This probably doesn't hold up legally, but it does hold up logically: if the reason a border search exemption exists is to prevent importation of material that is unlawful to import, wiping a storage device also fulfills that purpose.
It would seem that the officer was searching for evidence of a crime, not to prevent importation.
However, did that evidence really exist? And if it did, was it for something else? Perhaps, the guy just worried about something far more mundane being discovered? We shall never know.
They said they don't bother because it's non-trivial to implement convincingly, so they don't bother, lest it gives people a false sense of security. For instance, if you do this, and the adb logs aren't scrubbed, then that's massively suspicious and that'd still you in legal hot waters.
im not sure if grapheneos does or not, but it's not a novel idea, and often will only be a delay tactic.
forensics will reveal the other partition(s), and then you're in the exact same position having to answer "what's the other partition, provide the password"
That's probably safer because you can plausibly argue you're protecting your workstation, not unlike corporate security policies that require you to lock your workstation when you get up. Where they get into trouble is when they specifically say "use this when the IRS comes knocking". It's like offering an encrypted chat app (eg. signal) vs offering an encrypted chat app and marketing it to criminals.
Someone who is a lawyer knows any details about the US justice systems precedents with regards to the fifth amendmend (regards to self incrimination) vs obstruction of justice (by destroying evidence) as would be applicable to a duress wipe? Also would the distinction of being (or not) read their miranda rights and placed under arrest in this case make a difference as to the status of any possible obstruction?
Not a lawyer, but my understanding is that refusal to give the PIN (“remaining silent”) would be a valid application of the 5th, but not giving a false PIN. 5th does not imply the right to mislead or lie to someone investigating a crime.
Not clear on anything else regarding the duress PIN but I don’t think a 5th defense would apply.
Note that you apparently have to explicitly invoke your right to remain silent or your silence could be implied as an admission of guilt (thanks to Salinas v. Texas). I imagine you’d have to repeat your assertion multiple times, and the person demanding the PIN will tell you that you can’t use the 5th, will threaten you with arrest and additional charges, etc. Consult a lawyer and get training if you’re doing critical work where you may need this defense.
Hmm, interestingly here in Sweden we have "free evidence" (way of gathering is not considered even if "illegal", however someone doing something illegal to obtain it could instead be charged separately).
As such in a case like the Salinas one, being silent or "pleading the fifth" would be moot as both would just indicate "deafening silence" to the judges since the defendant had been cooperative up until that point.
(the Swedish judicial system has no juries, instead there's a professionally learned judge and 2 "laymen judges" appointed from political parties acting as the peoples representatives, if that triumvirate fucks up, higher courts can and often will kick rulings back down for retrials).
Interesting, did not know this. The “right to remain silent” has a long history here, and I think it’s important. The biggest reason for its continued existence, IMHO, is to shut down overly aggressive, threatening, or manipulative questioning. It’s easy for trained investigators to bully someone into a false confession, or even just a misstatement that could be turned against them. Having the right to shut up and pass future answers through a lawyer makes perfect sense in the face of this.
I'm mixed... if they really thought there was evidence on the phone, they should have seized the phone and acquired a warrant IMO to compel the valid, non-destructive PIN be given over.
As I mentioned earlier, this is part of why my own plans for international travel are to only go with a notebook/sheet with contact numbers and buy throwaway devices on the other side. I don't think I'd travel internationally with a phone or laptop at this point, and that's kind of been my thoughts for a while. Especially given the direction that many countries, not just the US have taken. For that matter, I don't think I'd ever even risk travelling to the UK or China at this point. Not that I like the surveillance state here in the US, at least I still have some rights preserved.
According to Homeland Security, within 100 miles of the border is a "constitution free zone". So there's a whole lot to unpack before we even get to miranda rights.
The moment you start talking, you're no longer using your 5th amendment rights. And anything that you tell an officer that is not truthful, such as providing the wrong password, can be considered a crime in itself. Even claiming you are innocent can be considered a separate crime if you are not proven innocent later on.
You can decide to apply your 5th amendment right at any time, you just have to be explicit that you’re doing so (Salinas v. Texas). And then you have to stand strong in the face of attempts to get you to continue talking.
Oh, yes, I just meant that as long as you're saying things, your speech is not protected by the 5th amendment. Not that if you've started speaking you can no longer stop and invoke the 5th later.
And this is why part of my plans for any international travel are to simply have a physical notebook with phone numbers to trusted friends/family and to buy throwaway devices on the other side (phone and chromebook or similar).
TBF, similar mindset if I ever attend defcon, etc. as well.
yasss
this is a feel good story
they entered the pass themselves, so by their own treasonous logic, they should charge themselves.
hope the crim charges get dismissed, and a civil suit is filed
get paid, donate a chunk
Go Team Graphene!!!!
The Fourth Amendment of the U.S. Constitution is supposed to protect people from random and arbitrary stops and searches. It's a fundamental American right. But in the 100 mile border zone, the federal government has tried to impinge on those basic rights. https://www.aclu.org/know-your-rights/border-zone
The border agents didn't act in good faith, regardless of what they're empowered to do. They wanted the data for one reason and fabricated another to prompt the device search. The data they were interested in pertained to protest activity protected under the constitution but the lie they told was about something criminal. That anything within 100 miles of the border is constitution free tosses that out, I guess, but is extremely problematic on its own.
> That anything within 100 miles of the border is constitution free tosses that out
That's a misconception. Border/immigration agents can operate inside this zone, including making stops with reasonable suspicion or running checkpoints where everyone is stopped with no suspicion. The checkpoints are limited in scope, and do not provide authority for searching electronic devices. Some people, including a couple dissenting supreme court justices do feel the checkpoint part violates the constitution.
That's distinct from the border search exemption, which allows inspection of everyone and everything crossing the border. It only exists when someone is actually crossing the border and not not allow CBP to stop or search people who are not crossing the border.
Gotta follow the law
What is the point you're trying to make?
Fascism
Interesting that all that rules don't apply to water. The moment you stepped on a boat, coastal guard can (and do regularly) board it and conduct a search without any reasoning. They don't need any probable causes, warrants, nothing.
Seems like so far it didn't create any problems, so public is ok with that.
Interesting that the distinction between phones and boats was not enough to dissuade whatever point it is that you're trying to make.
From Chief Justice Roberts in Riley v. California: "One of the most notable distinguishing features of modern cell phones is their immense storage capacity. Before cell phones, a search of a person was limited by physical realities and tended as a general matter to constitute only a narrow intrusion on privacy."
The same is true at any border crossing - you have to submit to searches by CBP agents, who don't need any probable cause. I believe device searches are still a somewhat greyer area, at least if password protected (as providing a password would be compelled speech, unlike a luggage search which can be conducted without any action from your part).
>as providing a password would be compelled speech
which is a good reminder for anyone with reason to be concerned about this sort of thing to turn off biometric/face id/etc. access to their devices.
that's why GrapheneOS has biometric+pin
The founding fathers would be aghast at what America became. Hard to imagine modern America passing some of those constitutional amendments that older America passed wayyy back.
On the other hand, why care what the American founding fathers thought? There have been two centuries since then of developments in democratic countries that some Americans could choose as a model they like more. And now it's the Chinese century anyway.
This should be an interesting case in today’s legal climate
Obviously grafeneOS has no liability. But the owner of the device didn’t take the action to remove the data, the CBP officer entered it. We already have some precedent around being forced to give up your password.
How does that change if you are forced to give up a password that is destructive? What if the password works fine at home and the same password does a wipe based on location? Either way, the user complied, and did not take action to wipe their device.
Intentions matter. If the intent is to trick the officer to enter a PIN code that will destroy potential evidence then it does not matter that you didn't type the PIN code. Your speech is the thing that triggers a series of events that you know will lead to a wipe. Just like you can be charged with destruction of evidence even if you trick someone else to take the action.
>Your speech is the thing that triggers a series of events that you know will lead to a wipe.
The owner of the phone doesn't know that. They have no control over or insight into the officer's brain to know what they'll do. The officer might suspect the phone-wiping functionality exists and decide not to enter the password. If we start talking about ultimate causes then judicial matters become infinitely complex. What immediately caused the phone being wiped is the wrong password being entered by the officer.
The level of duress also matters. US citizens have been shipped to foreign prisons and there's an active case of high-level officials at DOJ violating court orders about that.
>The level of duress also matters
Theoretically yes, but in this case there's approximately zero chance a judge would accept "I destroyed evidence because there's a vague chance ICE might send me to a deportation camp".
That's a bit of a strawman. No defense attorney would omit the other circumstances of the search, some of which very likely overstepped legitimate authority.
>some of which very likely overstepped legitimate authority.
That's not what you originally said though, which was "The level of duress also matters. US citizens have been shipped to foreign prisons ...".
Well the issue was that you made a good point, so now the goalpost has to move.
while attempting to avoid armchair-law-interpreting because I really do not intend that, and I agree that this is going to be an interesting/deeply-worrying legal case:
wiping the device before carrying it across the border seems essentially identical to me. like, saying "you can't wipe it when searched" would also imply "you can't have an empty device when crossing because it may have been wiped before the search to avoid having your data searched" since people can (and often do) do that for exactly that reason.
that may very well be what they want / what they are trying to legally allow during searches, but it also seems like it'd raise a hell of a lot more outrage. it's essentially claiming all citizens are under full legal hold all the time, if they ever intend to leave the country for any length of time.
To my knowledge, no citizen has ever been prevented from reentry due to a blank or absent device. In fact they cannot block a citizen’s legal reentry for any reason, they can only detain you while they investigate.
Beyond this, “I dropped my phone in the ocean” is always a perfectly valid reason.
If you’re a foreigner and they already suspect you of something, they can deny you entry for any reason. It may be better to be denied than arrested!
And this policy is already accepted in practice.
> wiping the device before carrying it across the border seems essentially identical to me.
On the contrary, there is a huge gulf between these. Providing a fake password that wipes a device while under active questioning is a clear case of providing false testimony. Lying to the police while under investigation is simply illegal, regardless of the thing you're lying about.
By contrast, entering the country with a clear device is not a crime under any possible interpretation that I can see. Now, if you are wiping evidence while you know there is an active investigation against you, that may be a crime as well, but it's a completely separate crime and can't be easily judged by an officer that simply finds you with a clean phone.
> Providing a fake password that wipes a device while under active questioning is a clear case of providing false testimony.
False testimony of what? Can you be compelled to provide testimony that allows a police officer access to your private data? Can a police officer demand I log into my online medical chart so they can complete their investigation?
> Lying to the police while under investigation is simply illegal, regardless of the thing you're lying about.
Perhaps for certain definitions of police, investigation, illegal, and lie. But as a blanket statement, not even remotely. Otherwise every person found guilty of any crime they said they didn't commit would also be found guilty of lying to the police officers who interrogated them.
similar to structuring laws, right? trying to not provide evidence is occasionally similar to destroying it.
isnt it amazing how we are able to know when something is a trick and clearly caused by your action/intention vs when it isnt? i mean sure we can contrive (or maybe even find example of) some scenario where it might be a hard grey area, but ive always found it so cool how we often operate on "top down" methods like this that logically have no basis for working out but 'common sense' happens to be common enough still
i pray that sense doesnt erode
> Intentions matter
Fed: "give us your PIN or else"
me: "528491"
Fed: <types 528491, presses OK>
me: "no! 528419, I meant 528419!!"
Fed: <watches phone wipe...>
You could still be brought before a jury to determine if you knowingly provided the wrong PIN (and thus knowingly gave false testimony) or not. Records of you intentionally setting two very similar PINs and discussing any such plan could be used to convince a jury that it was malicious.
>"write the pin on a piece of paper"
>"ok are you sure that's your pin?"
>they exit the room and come back 5 min later
>"that pin didn't work, can you write it again?"
You're going to have a hard time convincing the judge that you "accidentally" gave the wrong pin in this case.
See also, 5th amendment. They can't just declare on the spot that your data is now their data.
The 4th ammendemnt is the one that protects your data and other possessions in general, not the 5th. The 5th protects you from being compelled to give testimony that might incriminate you, which then protects you from being compelled to offer a password to access data that could be used to incriminate you.
Since 4th ammendemnt protections are significantly curtailed at border crossings, they can actually declare on the spot that your data is now their data. The only thing they can't do is force you to tell them how to access it - but, if they can hack your password, they actually have the right to search your phone just as much as they have the right to search you luggage.
If you have a safe in your home and you knowingly wire up a bomb that goes off when a certain lever is pulled then you lie to the police and tell them the way to open the safe is to pull that lever you'd pretty clearly be responsible for the damage done when the bomb goes off.
I don't see why this would be any different.
cause you're not harming the officer. this is more like a safe that destroys whatever is inside
Because booby traps are illegal and wiping your phone doesn’t kill or maim the officer
I fully agree but that is a different argument than the one mingus88 presented. They suggested that the owner did not wipe the device because they did not actively enter the pin, which seems to be a flawed idea because legally intent matters.
> Either way, the user complied, and did not take action to wipe their device.
The user claimed to offer a password to access the contents of the device, and instead offered a password that deleted the device. That is false testimony / lying to an investigation, and is almost certainly punishable in itself.
It would depend on precisely what the ask was. Did the officer ask, "Give me the pin to unlock the phone."? In that case the command was complied with.
Even if the prompt was vague like "what's the pin for the phone", you'd be hard pressed to convince a judge that a duress pin (to wipe the phone) is a reasonable person[1] interpretation.
[1] https://en.wikipedia.org/wiki/Reasonable_person
Not really, no. I think it would be extremely hard to convince any jury that you really believed that a PIN that wipes the phone was what the officer was asking for.
This is possibly the best advertising. GrapheneOS was kind of niche before. But if the US Government hates you then you're on the right track.
On one hand, I love GrapheneOS and see it as a cornerstone of digital privacy software. I have supported the project financially for years.
On the other hand, I'm worried that the publicity will only make explicit targets out of GrapheneOS users, and that you would only be using it "if you have something to hide".
Say that as they may, it’s a whole different slope to fall down if they want to do anything about that beyond pointing and whining. If we cross that bridge, we probably have bigger things to worry about. So I think it should be fine for now.
The DOJ is attempting to prosecute, so I suppose the success or failure of that will tell us what we need to know about bridges and slopes.
I have plenty of things to hide from Google which is the primary reason I use it.
The "agent entered password themselves, therefore they're to blame" seems as good of a logic as "I'm going to start swinging my arms and start walking forward, so if you don't move, it's YOU hitting YOURSELF".
Maybe digital forensics shouldn't be handled by barely highschool graduates at a busy border crossing
Should we take the same approach for physical searches? If the cops are executing a search warrant on a house, and there's a safe, should they send in a safe cracker on the off chance the safe is wired with a "duress pin" (eg. thermite that burns the contents)?
Isn't this already done? Don't they send narcotics back to a lab? And do sobriety tests back at the station if you refuse a field test?
>Don't they send narcotics back to a lab?
1. They do field tests before sending to a lab
2. They're sending it to a lab to ensure the results are accurate, not to guard against an off chance something is boobytrapped.
I mean, if it's possible to configure and there is at all a reason for someone to configure it as such, then it makes the most sense to treat it as a very valid possibility, right?
Hindsight is 20/20 right? Sure, the duress pin feature was around for years, but so was the technology to set up a thermite boobytrap in a safe. Maybe now CBP officers should be more careful about entering random pins people gave them, but snarky remarks like "Maybe digital forensics shouldn't be handled by barely highschool graduates at a busy border crossing" are entirely unjustified.
enough metaphors though. Here is what I think probably actually happened, based on the multiple accounts I've read:
"Give us the PIN for your phone"
"I don't want you to search my phone, and I want to talk to my lawyer"
"If you don't comply, you're going to be in a lot of trouble"
"Can I please just go, I don't want to answer questions or be searched"
"If you don't comply we will seize your phone and detain you indefinitely until we can unlock your phone!"
"I want my lawyer."
"Just tell us the PIN and you'll be on your way. Otherwise it's gonna be bad."
"Look if I have no choice my PIN is 1234, but I don't want you searching my phone without my lawyer present."
...
"Hey! We tried to search your phone and the phone wiped itself! You're going to prison for destruction of evidence!"
That's egregiously disingenuous. Having a password that protects the infiltration/extraction of your intellectual artifacts is in no way akin to assault on someone else.
A duress password isn't a booby trap. Nothing was damaged except for the fragile egos of the man-children who weren't able to bully someone into giving up their wrong-think.
The point isn't that giving a duress pin is the same as physical assault, or that the duress pin feature is a "booby trap". It's that for the purposes of ascertaining guilt, you don't get a pass just because you're not the person that physically initiated the action.
Easily illustrated with the comparison to burning a piece of paper with evidence in front of an officer trying to obtain it. Though even though the “guilt” there is the burner’s, that there is any guilt to assign at all depends on whether the law had jurisdiction to that paper in that situation.
Knowingly obstructing investigations is illegal even if there isn't an active search warrant
>During the fall of Enron, Arthur Andersen, Enron's accounting firm, instructed its employees to destroy documents relating to Enron after Andersen officials learned they would soon be investigated by the Securities and Exchange Commission.
https://en.wikipedia.org/wiki/Arthur_Andersen_LLP_v._United_...
The conviction was overturned, but only on procedural grounds
Then construct a better analogy, or better yet don’t rely on one at all
It is illegal to lie to a police officer in the US. It's better to remain silent than to tell a lie. Giving a false PIN is a lie. And that by itself is a crime.
I'm not taking sides here, I just wanted to make that clear.
And you should understand that they can lie to you. That's OK and legal, but you cannot lie to them.
This probably doesn't hold up legally, but it does hold up logically: if the reason a border search exemption exists is to prevent importation of material that is unlawful to import, wiping a storage device also fulfills that purpose.
It would seem that the officer was searching for evidence of a crime, not to prevent importation.
However, did that evidence really exist? And if it did, was it for something else? Perhaps, the guy just worried about something far more mundane being discovered? We shall never know.
Think Schrodinger's password.
As a GrapheneOS user and a U.S. citizen that cares about the constitution, I fully support the actions taken by the individual
Couldn’t GrapheneOS provide a special pin which boots into an “empty”session? Where the user can install some default stuff to not look suspicious?
They said they don't bother because it's non-trivial to implement convincingly, so they don't bother, lest it gives people a false sense of security. For instance, if you do this, and the adb logs aren't scrubbed, then that's massively suspicious and that'd still you in legal hot waters.
Right, they should restore the phone to a user-picked previous state, as opposed to wiping it clean.
im not sure if grapheneos does or not, but it's not a novel idea, and often will only be a delay tactic.
forensics will reveal the other partition(s), and then you're in the exact same position having to answer "what's the other partition, provide the password"
"defends" is doing quite a bit of flashy work for this headline. "Feature works as advertised, nobody upset" would be a much more practical headline.
The government appears to be quite upset. You wouldn't want to upset ingsoc would you?
It's great publicity for GrapheneOS, has probably led to a huge spike in traffic to their website and downloads.
And ongoing publicity as the trial happens.
any reason with graphine os to wipe vs power off? Unless you have an easy bfu password doesn't it protect you from multiple password attempts?
Keep fighting the good fight GrapheneOS!
UBS had a similar capability on their laptops so they facilitate tax evasion for US clients: https://www.cnbc.com/2015/04/30/why-did-the-us-pay-this-form...
That's probably safer because you can plausibly argue you're protecting your workstation, not unlike corporate security policies that require you to lock your workstation when you get up. Where they get into trouble is when they specifically say "use this when the IRS comes knocking". It's like offering an encrypted chat app (eg. signal) vs offering an encrypted chat app and marketing it to criminals.
https://en.wikipedia.org/wiki/Phantom_Secure#Law_enforcement...
Only the people working on tax evasion had this on their laptops?
Probably all bankers.
Someone who is a lawyer knows any details about the US justice systems precedents with regards to the fifth amendmend (regards to self incrimination) vs obstruction of justice (by destroying evidence) as would be applicable to a duress wipe? Also would the distinction of being (or not) read their miranda rights and placed under arrest in this case make a difference as to the status of any possible obstruction?
Not a lawyer, but my understanding is that refusal to give the PIN (“remaining silent”) would be a valid application of the 5th, but not giving a false PIN. 5th does not imply the right to mislead or lie to someone investigating a crime.
Not clear on anything else regarding the duress PIN but I don’t think a 5th defense would apply.
Note that you apparently have to explicitly invoke your right to remain silent or your silence could be implied as an admission of guilt (thanks to Salinas v. Texas). I imagine you’d have to repeat your assertion multiple times, and the person demanding the PIN will tell you that you can’t use the 5th, will threaten you with arrest and additional charges, etc. Consult a lawyer and get training if you’re doing critical work where you may need this defense.
Hmm, interestingly here in Sweden we have "free evidence" (way of gathering is not considered even if "illegal", however someone doing something illegal to obtain it could instead be charged separately).
As such in a case like the Salinas one, being silent or "pleading the fifth" would be moot as both would just indicate "deafening silence" to the judges since the defendant had been cooperative up until that point.
(the Swedish judicial system has no juries, instead there's a professionally learned judge and 2 "laymen judges" appointed from political parties acting as the peoples representatives, if that triumvirate fucks up, higher courts can and often will kick rulings back down for retrials).
Interesting, did not know this. The “right to remain silent” has a long history here, and I think it’s important. The biggest reason for its continued existence, IMHO, is to shut down overly aggressive, threatening, or manipulative questioning. It’s easy for trained investigators to bully someone into a false confession, or even just a misstatement that could be turned against them. Having the right to shut up and pass future answers through a lawyer makes perfect sense in the face of this.
I'm mixed... if they really thought there was evidence on the phone, they should have seized the phone and acquired a warrant IMO to compel the valid, non-destructive PIN be given over.
As I mentioned earlier, this is part of why my own plans for international travel are to only go with a notebook/sheet with contact numbers and buy throwaway devices on the other side. I don't think I'd travel internationally with a phone or laptop at this point, and that's kind of been my thoughts for a while. Especially given the direction that many countries, not just the US have taken. For that matter, I don't think I'd ever even risk travelling to the UK or China at this point. Not that I like the surveillance state here in the US, at least I still have some rights preserved.
According to Homeland Security, within 100 miles of the border is a "constitution free zone". So there's a whole lot to unpack before we even get to miranda rights.
The moment you start talking, you're no longer using your 5th amendment rights. And anything that you tell an officer that is not truthful, such as providing the wrong password, can be considered a crime in itself. Even claiming you are innocent can be considered a separate crime if you are not proven innocent later on.
You can decide to apply your 5th amendment right at any time, you just have to be explicit that you’re doing so (Salinas v. Texas). And then you have to stand strong in the face of attempts to get you to continue talking.
Oh, yes, I just meant that as long as you're saying things, your speech is not protected by the 5th amendment. Not that if you've started speaking you can no longer stop and invoke the 5th later.
And this is why part of my plans for any international travel are to simply have a physical notebook with phone numbers to trusted friends/family and to buy throwaway devices on the other side (phone and chromebook or similar).
TBF, similar mindset if I ever attend defcon, etc. as well.
The crazy part is that you might be denied entering the country you don't travel with a device...
So be it, they can send me back.
I have never heard of something like that.
Related:
US Government targets Cop City protester over phone operating system
https://news.ycombinator.com/item?id=49024436
No warrent? No data. Easy as.
no warrant required at a border crossing.
yasss this is a feel good story they entered the pass themselves, so by their own treasonous logic, they should charge themselves. hope the crim charges get dismissed, and a civil suit is filed get paid, donate a chunk Go Team Graphene!!!!
The Fourth Amendment of the U.S. Constitution is supposed to protect people from random and arbitrary stops and searches. It's a fundamental American right. But in the 100 mile border zone, the federal government has tried to impinge on those basic rights. https://www.aclu.org/know-your-rights/border-zone
Next version should wipe the phone while presenting a dummy account so they can't easily tell anything is missing.
is it just me or is it about once a decade somebody gets publicised for this and the government *really* throws the book at them.