ZH version is available. Content is displayed in original English for accuracy.
Advertisement
Advertisement
⚡ Community Insights
Discussion Sentiment
50% Positive
Analyzed from 1677 words in the discussion.
Trending Topics
#phone#crime#evidence#grapheneos#person#law#encryption#federal#key#https

Discussion (60 Comments)Read Original on HackerNews
Talk about burying the lede
Sam was physically in the US, but because he was on an international flight, he was arrested in a manner that would be unconstitutional anywhere else in the US. He was denied a lawyer, questioned for I presume hours, had his phone stolen without a warrant, and then was released because there was no crime CBP could figure out how to charge him with then and there.
Months later, he gets charged by a federal statute even though where he committed the crime was a place that federal law does? doesn't? extend. Apparently it's a very convenient place where the constitution is void but federal laws still matter.
Cops can't arrest or detain you without some articulable suspicion of a crime being committed. They can't steal your stuff to try and find a crime you committed. They can't search your phone without a warrant in which they provide a judge with enough evidence to reasonably suspect a crime has been committed.
Yet Sam apparently had no rights because he was put on a watchlist for exercising first amendment rights.
Very despicable behavior by the government and the federal prosecutors pursuing this case.
Instead of wiping and rebooting, it should wipe while showing a lame spreadsheet application, or possibly a grocery list.
Leaked documents from mobile forensics companies, such as Cellebrite or XRY confirm this. It's impossible to crack a Pixel with GrapheneOS in BFU state. See https://grapheneos.social/@GrapheneOS/112462758257739953 and https://grapheneos.social/@GrapheneOS/112826067364945164
Doesn't really matter if the reboot timer is triggered if the thugs have beaten your code out of you.
It shouldn't be this way, but oh well.
However, it makes an erroneous equivocation that, I believe, has profound technical and legal implications. In the article's first paragraph, it claims that GrapheneOS "enables users to enter a passcode and wipe a phone clean". What the author of the article is referring to is GrapheneOS's duress password/PIN feature[1], which does not (contrary to what it may seem on first glance) delete or modify the data on the persistent flash storage phone in any way. What it does is zero the key slots in the phone's Secure Element, which stores the disk encryption keys necessary to decrypt the data on persistent storage (technically, these disk encryption keys are not themselves stored in the secure element, but are first encrypted with a key encryption key/KEK derived from a user-entered passcode/PIN and then stored in the secure element[2]. If an adversary were able to break the secure element and extract the contents of the key slots, they would still need to brute-force the KEK in order to obtain the actual disk encryption keys).
To my knowledge, US law does not explicitly say whether deleting the key necessary to decrypt a given ciphertext is equivalent to deleting the ciphertext itself. Technically speaking, they are not equivalent, even if it would take an exorbitant amount of time to recover a deleted key using a brute-force search or some forensic method. If the federal government wants to claim, using this case to set a legal precedent, that it is equivalent, then I would argue that this in effect makes encryption as a concept illegal (as encryption is nothing without the ability of the person using encryption to control access to the encryption key(s)). Reading about the recent Prairieland trial, in which (among other blatant injustices) an activist was convicted by a kangaroo court of "destroying evidence" because they merely removed someone from a Signal group[3], it's clear to me that Prairieland along with Sam's case is part of a coordinated strategy under the NSPM-7 "Antifa Memorandum"[4]: the federal government is using lawfare to establish that it has a right to arbitrarily access the data of its citizens in order to crush political dissent.
[1] https://grapheneos.org/features#duress
[2] https://grapheneos.org/faq#encryption
[3] https://www.theguardian.com/us-news/ng-interactive/2026/jun/...
[4] https://en.wikipedia.org/wiki/NSPM-7
"Corrupting and concealing documents, interfering with their ability to be used in grand jury and criminal proceedings; Conspiracy to conceal documents that would implicate Maricela Rueda"
By removing people from the Signal group?
I’m sure this case will be dropped because it will open bigger can of worms and may jeopardize the current practice of warrantless invasive searches at the entry points. Secretly I hope this goes to Supreme Court and once and for all they clarify on “constitution doesn’t apply at the border” piece of thinking
https://news.ycombinator.com/item?id=48994716
2 days ago 87 comments
Dark forest
Most of the EU is lovely.
If he was under arrest, sure. The cops claiming this was a routine airport inspection would seem to muddy the waters, at least.
Now, could that get tossed about because they denied him access to a lawyer? Maybe, I don't know about that part.
Isn’t the relevant bit whether you think you’re doing crimes and/or being investigated?
If I’m shredding while the cops knock on my door because they’re looking for a missing cat, that’s obviously not criminal. (I guess the more-pertinent comparison would be they knock on my door and then I put stuff in the shredder while I check around my home.)
> A person commits the offense of tampering with evidence when, with the intent to prevent the apprehension or cause the wrongful apprehension of any person or to obstruct the prosecution or defense of any person, he knowingly destroys, alters, conceals, or disguises physical evidence or makes, devises, prepares, or plants false evidence
> (a) Every person concerned in the commission of a crime is a party thereto and may be charged with and convicted of commission of the crime
>(b) A person is concerned in the commission of a crime only if he: (1) Directly commits the crime; (2) Intentionally causes some other person to commit the crime under such circumstances that the other person is not guilty of any crime either in fact or because of legal incapacity; (3) Intentionally aids or abets in the commission of the crime; or (4) Intentionally advises, encourages, hires, counsels, or procures another to commit the crime
Seems like this is a clear case to me.
GraphenOS has a couple of settings, a distress pin that wipes the device, and a number of failed attempts that will wipe the device. If the person handed over their "pin", they didn't need to