Edit history

The purpose of a duress code is plausible deniability.

There is an encryption product for Windows called VeraCrypt (aka TrueCrypt). You can create a hidden decoy volume inside an outer encrypted volume which has all your stuff in it. When mounted an observer cannot tell the difference between the hidden volume and the real volume since they are mounted the same way with different passcodes. You can put files in the decoy for plausibility but not the things you actually want to hide.

The same should be true of a duress code in a phone. It should be possible to put files, apps and stuff in the decoy that show activity e.g. email, pictures etc. Providing the other profile is wiped while this screen is showing then there is no immediate way of proving it was a duress code.

It would have to at least convince the border guard, but it should withstand forensic analysis too. So it might be necessary to do what VeraCrypt does.

The purpose of a duress code is plausible deniability. There is an encryption product for Windows called VeraCrypt (formerly TrueCrypt). You can create a hidden volume which is the decoy and a real outer volume which has all your stuff in it. The inner volume is imperceptible because the entire volume is encrypted. And when mounted an observer cannot tell the difference between the hidden volume and the real volume since they are mounted the same way with different passcodes. You can still put files in the decoy and you probably want to put things in there that you would want to plausibly hide but not the things you actually want to hide.

The same should be true of a duress code in a phone. It should be possible to put files, apps and stuff in the decoy that show activity so a border guard demanding to open the phone sees stuff like email, pictures etc. Providing the other profile is wiped or corrupted while this screen is showing then there is no immediate way of proving it was a duress code.

It may be necessary to do this similar to VeraCrypt with outer and inner volumes and the means for somebody to occasionally log into the decoy to simulate activity, but that’s the proper way to do this.