posted in Technology

US accuses American of allegedly wiping his phone using a 'duress' password during border search

cross-posted from: lemmy.world/post/49853131

Feels to me like GrapheneOS did exactly what it should, passing the US border test with flying colours!

Funny part about this lawsuit: “With a little planning ahead of time, you can always download the data you need once you get to where you’re going,”

techcrunch.com/2026/07/24/us-accuses-american-of-allegedly-wiping-his-phone-using-a-duress-password-during-border-search/
TechCrunchUS accuses American of allegedly wiping his phone using a 'duress' password during border search | TechCrunchA U.S. citizen has asked a court to throw out the government's claim that he gave over a passcode to border authorities that wiped his phone's data, opening up fresh questions about a person's constitutional rights at the U.S. border.
enPage

Replying to @⁨CompactFlax@discuss.tchncs.de⁩

100 miles, but it does not include airports. www.aclumaine.org/…/100-mile-border-zone/

ACLU of MaineKnow Your Rights: Customs and Border Patrol and the 100-Mile Border Zone - ACLU of MaineAll of Maine is within 100 miles of the border, meaning CBP has broad authorities. Know your rights with CBP in Maine. The Fourth Amendment of the U.S. Constitution protects people from random and arbitrary stops and searches. But U.S. Customs and Border Protection (CBP), which includes U.S. Border Patrol, operates broadly in border areas. […]

Replying to @⁨CompactFlax@discuss.tchncs.de⁩

Search is not the same thing. Search means they CAN legally search. It absolutely does mean that wiping your phone prevented, obstructed, or obscured a SEARCH. Search all you fucking want, that data is gone. It’s not retroactively comparable.

That being said, had there been a judge that said “You can’t wipe your phone, because you are being charged with a crime, and we believe there is evidence of this crime on your phone, and here is why…”

Way different, and these laws only exist to prevent law enforcement from being caught in a cyclical legal roundabout in court related to the 4th amendment, and even then, many defense lawyers get “gray area” material data evidence thrown out because of Miranda Rights, or illegal searches by law enforcement of data harvested when the defendent was not properly advised or advocated for their ability to refuse.

Murderers get off for this shit because Cops get overzealous and don’t follow the letter of the law or chain of custody in evidentiary collection.

Replying to @⁨just_another_person@lemmy.world⁩

From the article

“The government’s indictment, which contains a typo (“Untied States Code”), accuses Tunick of allegedly providing a passcode to border agents that caused the phone to “delete the digital contents,” prior to the device being seized.”

“When Tunick provided his passcode and the authorities entered it, “the screen went blank, flashed several times and the phone appeared to restart.” The authorities seized his phone anyway, before telling him that he was free to go and could enter the United States.”

Replying to @⁨just_another_person@lemmy.world⁩

No it can be police that charge.

My state 100% has this law and police charge suspects for this.

ORC 2921.12 Tampering with evidence.

(A) No person, knowing that an official proceeding or investigation is in progress, or is about to be or likely to be instituted, shall do any of the following:

(1) Alter, destroy, conceal, or remove any record, document, or thing, with purpose to impair its value or availability as evidence in such proceeding or investigation;

(2) Make, present, or use any record, document, or thing, knowing it to be false and with purpose to mislead a public official who is or may be engaged in such proceeding or investigation, or with purpose to corrupt the outcome of any such proceeding or investigation.

(B) Whoever violates this section is guilty of tampering with evidence, a felony of the third degree.

Replying to @⁨Zen_Shinobi@lemmy.world⁩

In your Section A right there: “official proceeding”

There was no crime in progress, suspicious activity, or active charges brought against this person.

Maybe reread the article.

Also, Police do not bring charges, Prosecuting Attorneys do. Police are only responsible for investigations and arresting. Everything else is cleared by the legal system first.

Replying to @⁨just_another_person@lemmy.world⁩

You’re wrong and arguing in bad faith now.

People get charged with tampering for all types of shit, like eating drugs during an arrest. The laws surrounding the bordes are dumb as fuck, but legally-speaking border operations can be construed as official proceedings, although it’s only an investigation that is required. Which it obviously was.

Prosecutors ultimately argue charges, but police organize those charges before presenting them to the the state.

Knock it off. Stop being a contrarian weirdo.

Replying to @⁨chloroken@lemmy.ml⁩

You seem to have zero knowledge on the subject, so let me educate you a lil bit:

Data isn’t treated like physical evidence.

Drugs and weapons are physical evidence.

US laws do not cover any protections of ephemeral (non-physical) evidence pertaining to crimes committed ex post facto: meaning law enforcement is not privy to any and all collection of said data if not in scope for a crime committed, unlike…PHYSICAL EVIDENCE.

You can see drugs. You can hold drugs. Law enforcement can make a reasonable assumption that someone shooting a gun in public is breaking the law and seize that gun, because they are actually breaking the law (juris laws dependent) by firing the gun.

If suddenly our laws allowed the assumption that whatever exists on a phone for a random person in public contains something related to a crime, police would be able to stop anyone and everyone on the street everywhere and take their phone or data for simply thinking every person is suspicious. This is why the 4th amendment exists, and why police are enot allowed to do such things. His is why warrants are a thing.

Read up.

Replying to @⁨CompactFlax@discuss.tchncs.de⁩

Not every search is comparable to one another. Searching a car for immigrants near the border fence is one thing while searching an American citizen’s personal phone containing all kinds of private informatoon at an airport in the middle of Georgia is another. This is all based off allegations of CSAM, but I would imagine the federal government would actually have to make a case for why they suspected CSAM in the first place to make the seizure legitimate. In reality, they probably wanted this guys messages and phone calls related to his activism so that they can target those people too, which is going to be hard to make a case for in court depending on the judge.

Replying to @⁨just_another_person@lemmy.world⁩

It depends. If the police suspect the owner has evidence of some sort on the phone, destroying it can lead to a tampering with evidence charge from the police.

A tampering charge doesn’t have to be from a court order. If someone eats or dumps out drugs where the police can’t collect the physical drug, it will stick.

But in the story’s case, it falls within the 100 miles of the US boarder (called a boarder search exception) a warrant, probable cause, or RAS aren’t needed here. It’s considered a reasonable search so the 4th amendment is limited here.

There is a lot to it and really don’t think this is the best format for it here.

Replying to @⁨chloroken@lemmy.ml⁩

Did you read the article and the laws pertaining to data seizure at the border? Crossing the border doesn’t constitue an investigation of ANY kind, and also doesn’t suddenly conjure up some sort of suspicion that a crime is in progress or has been committed, meaning no pretense for charges because PERSONAL DATA was not seized. Good lawd.

Replying to @⁨just_another_person@lemmy.world⁩

Perfectly legal. Unless they were legally charged and ordered by a court to preserve data considered to be used in a crime, they can’t be charged with shit. Cops don’t dictate this, courts do, AND that scope only applies to an active prosecution anyway.

I’m not a lawyer, so I’m not arguing that you’re wrong here, but the article describes the federal law the journalist was charged with. It seems very broad, and it’s a bullshit law, but from what’s here, it seems more grey area than perfectly legal. All of 2232 seems to require knowledge (which it seems like he had, but might be arguable) and action. You could argue that the journalist didn’t take any affirmative action to wipe the phone. The action that wiped it was the feds entering a code.

LII / Legal Information Institute18 U.S. Code § 2232 - Destruction or removal of property to prevent seizure

Replying to @⁨Valmond@lemmy.dbzer0.com⁩

I have my Personalausweis and Reisepass but sometimes don’t even need it when being checked in, depending from which country to which. It’s strange sometimes.

Ah yes I actually had to look up the definition of ages with the translation. For me it subjectively differs in the meaning with the German translation so you’re right, it just means a long time. For me ages is more akin to ancient 😁 so I might need to rectify that.

Replying to @⁨terezi@lemmy.blahaj.zone⁩

On GrapheneOS, you can also set a “second factor PIN” in the unlock settings under “Fingerprint Unlock”, so that to unlock your screen you need to first use the fingerprint unlock and then separately enter your PIN. This means BOTH are required every time you unlock. Your phone can’t be unlocked unless it’s your finger AND unless you enter the PIN that only you know.

And under the Screen Lock settings you can also enable “Scramble PIN input layout”, so that the number buttons on your unlock screen will be out of order, so people watching you or recording you can’t just make note of the shape your index finger is making when touching the numbers to unlock your phone(like people looking over your shoulder or recording on store security cameras).

Replying to @⁨itisileclerk@lemmy.world⁩

I don’t believe you can be compelled to provide a password. That does after all (at the very least) constitute speech. And freedom of speech is also freedom of non-speech, they can’t make you say something.

They will however try to make you do that… In many situations authorities are allowed to lie to you. So that’s sucks. They can tell you that you’re required to unlock your phone, you just have to know that your not actually.

Also they can’t make you say anything, but they can make you do things, like for instance “put your finger here” or “look into this camera”, which is why biometric unlock is unsafe around cops.

Replying to @⁨Cocodapuf@lemmy.world⁩

There’s that one guy who is being held in contempt of the court (to be clear this is not the police asking for his password, but a judge in a court of law) because he won’t give a password to decrypt a hard drive.

They believe it is highly likely that the drive contains sexually explicit material of children, which is why he’s being held in prison until he gives up the password.

Replying to @⁨BlackAura@lemmy.world⁩

I would want to catch pedophiles too, but I seriously don’t believe a damn thing any branch of this government says about anyone.

For all I know he has a video of trumps night out at Epstein island and that’s why they want the password to destroy it.

Obviously probably not but still, I’m supposed to just take the scouts honor of our unhonorable government that this guy totally has this on his hard drive even if they can’t prove it?

They could say this about any of us at any time for any devices password we won’t give them.

I don’t agree with this precedent.

Replying to @⁨itisileclerk@lemmy.world⁩

The important thing is this: can you still deliver lectures to the rest of the world on the Importance of Freedom Of Speech, and the fact that only Yanks have it because Elon can worship Hitler on the Internet?

And the answer is, yes. Yes you can, and always will. So the actual reality isn’t really important. Because all you actually learned from 1984 is that of the government tells you that you have freedom of speech, and also tells you that Eastasia and Eurasia don’t, That’s Good Enough For You and you’re The Free-est People In The World.

Replying to @⁨badbytes@lemmy.world⁩

yes you can. On Graphene you can set the main profile as just there with nothing except to control wifi/add esim/etc. Then you can create many profiles with their own passwords. You can store your work stuff in 1 profile, private stuff in another. You can even create a dummy profile with fake Google. .

The downside currently is that the OS autoboot to main profile. Then you switch to your other profiles.

Replying to @⁨mazzilius_marsti@lemmy.world⁩

Good writeup, and the downside you flagged is the interesting bit. Profiles are enumerable. A dummy profile survives a glance at the screen and stops working the second someone can see profile 2 exists and asks you to open it.

The property you want on top of your setup is that the second thing can’t be shown to exist at all, so it looks like random noise rather than a locked door. Then the dummy isn’t a dummy, it’s just the phone.

(I work on DeniableOS, which is built around that. Your profile setup is still the right free answer for most people and I wouldn’t talk anyone out of it.)

Replying to @⁨badbytes@lemmy.world⁩

That exists. The thing to watch is the difference between separate profiles and a hidden one.

Graphene gives you multiple profiles with their own passwords, but profiles are enumerable. Anyone poking at the device sees that profile 2 is there, so “open that one too” is the obvious next sentence.

The version you’re describing works when the second environment can’t be shown to exist at all, so it reads as encrypted random noise, which is what empty encrypted space looks like anyway. One PIN gets you a full boring phone, the other gets you your real one.

Only holds up if the boring phone is actually convincing though. Six apps and no photos fails on the spot.

(I work on DeniableOS, which does the hidden version, so weigh that how you like.)

Replying to @⁨LovableSidekick@lemmy.world⁩

No they would have to prove that what was on his phone was evidence in the first place. Which is why arrest and search warrants list all kinds of potential evidence and if it isn’t listed in the warrant they can’t collect or use it against you.

I’m not exactly sure how this works during a border patrol search. It’s technically his phone and if it’s locked they would need his permission or a warrant to search it.

Replying to @⁨madeindex@lemmy.world⁩

GrapheneOS - the only OS that i just installed and forget about it. Sure i spend time to tweak things like profiles but thats it.

And I am a distro and rom hopper.

The security model is that good: duress pin, scrambled pin, separate profiles with their own passwords, usb c restriction (you can set it charge only, charge while phone is off (most secure state).

Replying to @⁨WhyJiffie@sh.itjust.works⁩

You can only install Graphene on a Google phone and there’s two big issues with that:

  1. you are rewarding Google by buying their hardware.
  2. it doesn’t matter how secure the os claims to be if the hardware is compromised and there is nothing you can do to convince me that a pixel has a backdoor into your data at a hardware level. If I was a conspiracy minded type I might say that Graphene is a Trojan Horse.

Replying to @⁨INHALE_VEGETABLES@aussie.zone⁩

What if you owned: weed/drugs, illegal firearms, items which could be used for potential murder, negative opinions about the fascist government?

This argument is shallow to the point where fascism is what you’re advocating here for. So what, if you did own something thats not law abiding - without any credible proof there is nothing there, and non of anybody’s interest.

Replying to @⁨madeindex@lemmy.world⁩

„unlawful to knowingly destroy or damage property to prevent authorities from seizing it” - but did it fucking explode, catch on fire, or blew some fuse on the phone or in any other way prevented it from working? No, they (not him) just wiped the data. I didn’t know deleting files off YOUR OWN DEVICE is a crime. I need to think twice before I empty trash on my computer next time.

Replying to @⁨madeindex@lemmy.world⁩

Because the reboot is not cosmetic. The duress PIN destroys the key derivation material, and a device with no keys has nothing left to boot into, so you get the restart and the blank slate. There is no version of that which looks quiet.

The thing worth adding to your instinct: quietly unlocking to an empty phone has the same problem as the flashy version. An empty phone is itself a statement. Nobody carries a device with four apps and a two week message history, so a careful look at an empty phone raises the same question the reboot does, just more slowly.

What answers your instinct properly is quietly unlocking to a phone that is full. A complete ordinary device, real apps, real photos, real message history, while the sensitive environment sits behind a separate credential and is stored so that it reads as encrypted random noise, which is what unused encrypted space looks like anyway. Nothing is destroyed, so the phone just unlocks and keeps working, and there is nothing afterwards for anyone to describe as destruction.

The honest catch is that the decoy has to be genuinely convincing, and keeping one that looks like a real life is ongoing work that most people quietly stop doing after a month. A thin decoy is worse than no decoy.

Disclosure: I work with DeniableOS, which is built around that approach, so weigh that accordingly. GrapheneOS is excellent, and their own statement this week says the same thing you are circling, that people should think hard about a wipe because it can carry physical or legal consequences.

Replying to @⁨madeindex@lemmy.world⁩

You guys already spotted the hole in the burner plan. A clean phone and a wiped phone look identical from the other side of the desk, and both look like someone who planned ahead.

A burner only works if it’s lived-in instead of clean. Real accounts, months of boring messages, photos of nothing in particular. That’s a lot more effort than grabbing a spare handset the week before you fly, which is why hardly anyone does it properly.

Same idea with less upkeep: keep one genuinely lived-in phone and put the sensitive half behind a second PIN, stored so you can’t show it’s there. Then the thing you hand over isn’t a prop, it’s just your phone.

(I work on DeniableOS, which is that. Changes nothing about what CBP is allowed to do to you, and I’m not a lawyer.)