Back to News
Advertisement
Advertisement

⚡ Community Insights

Discussion Sentiment

50% Positive

Analyzed from 1677 words in the discussion.

Trending Topics

#phone#crime#evidence#grapheneos#person#law#encryption#federal#key#https

Discussion (60 Comments)Read Original on HackerNews

bdcravens1 day ago
"federal authorities had put him on a terrorism watchlist because of his alleged association with the movement against Cop City"

Talk about burying the lede

Tyrubias1 day ago
Burying the lede on what? The individual in question was being targeted in part because he was exercising his First Amendment right to protest environmental destruction and the militarization of police. I think if anything this makes it more disturbing. The US government has a long history of criminalizing movements they don't like as "terrorism".
numeri1 day ago
You're agreeing with the person you responded to (bdcravens). Burying the lede means that bdcravens thinks the true headline should have been about being put on a terrorist watch list for protesting a police training camp, not about the phone.
cogman10about 24 hours ago
This whole thing highlights how insane US border law is.

Sam was physically in the US, but because he was on an international flight, he was arrested in a manner that would be unconstitutional anywhere else in the US. He was denied a lawyer, questioned for I presume hours, had his phone stolen without a warrant, and then was released because there was no crime CBP could figure out how to charge him with then and there.

Months later, he gets charged by a federal statute even though where he committed the crime was a place that federal law does? doesn't? extend. Apparently it's a very convenient place where the constitution is void but federal laws still matter.

Cops can't arrest or detain you without some articulable suspicion of a crime being committed. They can't steal your stuff to try and find a crime you committed. They can't search your phone without a warrant in which they provide a judge with enough evidence to reasonably suspect a crime has been committed.

Yet Sam apparently had no rights because he was put on a watchlist for exercising first amendment rights.

Very despicable behavior by the government and the federal prosecutors pursuing this case.

goatloverabout 22 hours ago
Indeed. Hopefully the next administration will hold current officials accountable for such abuses of power.
donkey_brainsabout 19 hours ago
Yeah, and then they’ll give everyone a pony
m4631 day ago
This is a technical problem.

Instead of wiping and rebooting, it should wipe while showing a lame spreadsheet application, or possibly a grocery list.

woodruffw1 day ago
I don’t think a judge would be impressed by this. If anything it actually makes the legal case easier: there’s a legitimate use for a wiping feature on a phone (e.g. for theft or tampering), but actively producing false information demonstrates an intent to deceive or mislead.
cherryteastain1 day ago
Easier solution: phone wipes itself if passcode is not entered every X hours
Andromxdaabout 13 hours ago
GrapheneOS already has an auto-reboot feature that can be set to time intervals ranging from 10 minutes to 72 hours. Rebooting puts the device back in before first unlock (BFU) state. This wipes all memory contents, including the encryption keys. Any unlock attempt will have to go through the secure element, which is basically impossible to tamper with (no successful attacks on the Titan M2 so far, or the Apple SEP for that matter), and includes substantial security mechanisms, such as throttling key derivations (through the Weaver API), or insider attack resistance (requiring user authentication before new firmware can be flashed to the secure element).

Leaked documents from mobile forensics companies, such as Cellebrite or XRY confirm this. It's impossible to crack a Pixel with GrapheneOS in BFU state. See https://grapheneos.social/@GrapheneOS/112462758257739953 and https://grapheneos.social/@GrapheneOS/112826067364945164

ragallabout 4 hours ago
There's a problem with that too: it would often force the owner of the phone to input the code when outside a secure environment, so a simple video surveillance could obtain the code.
atoav1 day ago
Deadmans-switch, nice. I always had a weird fascination for that kind of mechanism, because it inverts the whole situation. Where before you have to actively wipe a phone, now them taking your phone may be the mechanism that triggers the wipe.
Cider99861 day ago
Or just don't wipe your phone and let the reboot timer do its work and bring your phone to BFU state, effectively uncrackable.
cogman10about 24 hours ago
The issue here is CBP was (illegally) demanding he give them his passcode (5th amendment violation).

Doesn't really matter if the reboot timer is triggered if the thugs have beaten your code out of you.

blooalienabout 23 hours ago
There's an XKCD for that: https://xkcd.com/538/
unethical_banabout 22 hours ago
Or turn your phone off while transiting airports. Not a catch-all solution in life, but considering the extra-lack of rights we have there, it makes sense. No need for them if you write down your confirmation number before arriving for departure, in order to get your ticket printed. On landing, have it off until you clear TSA and Customs.

It shouldn't be this way, but oh well.

pstuartabout 18 hours ago
At least disable biometric login.
bonkusbingusabout 23 hours ago
This is a good article, and it brings much-needed attention to this case, which so far has not received the level of public awareness that is consummate with seriousness with which the federal government intends to weaken or undermine the First, Fourth, and Fifth Amendment rights of every American in prosecuting these bogus charges against Sam.

However, it makes an erroneous equivocation that, I believe, has profound technical and legal implications. In the article's first paragraph, it claims that GrapheneOS "enables users to enter a passcode and wipe a phone clean". What the author of the article is referring to is GrapheneOS's duress password/PIN feature[1], which does not (contrary to what it may seem on first glance) delete or modify the data on the persistent flash storage phone in any way. What it does is zero the key slots in the phone's Secure Element, which stores the disk encryption keys necessary to decrypt the data on persistent storage (technically, these disk encryption keys are not themselves stored in the secure element, but are first encrypted with a key encryption key/KEK derived from a user-entered passcode/PIN and then stored in the secure element[2]. If an adversary were able to break the secure element and extract the contents of the key slots, they would still need to brute-force the KEK in order to obtain the actual disk encryption keys).

To my knowledge, US law does not explicitly say whether deleting the key necessary to decrypt a given ciphertext is equivalent to deleting the ciphertext itself. Technically speaking, they are not equivalent, even if it would take an exorbitant amount of time to recover a deleted key using a brute-force search or some forensic method. If the federal government wants to claim, using this case to set a legal precedent, that it is equivalent, then I would argue that this in effect makes encryption as a concept illegal (as encryption is nothing without the ability of the person using encryption to control access to the encryption key(s)). Reading about the recent Prairieland trial, in which (among other blatant injustices) an activist was convicted by a kangaroo court of "destroying evidence" because they merely removed someone from a Signal group[3], it's clear to me that Prairieland along with Sam's case is part of a coordinated strategy under the NSPM-7 "Antifa Memorandum"[4]: the federal government is using lawfare to establish that it has a right to arbitrarily access the data of its citizens in order to crush political dissent.

[1] https://grapheneos.org/features#duress

[2] https://grapheneos.org/faq#encryption

[3] https://www.theguardian.com/us-news/ng-interactive/2026/jun/...

[4] https://en.wikipedia.org/wiki/NSPM-7

x79p12gzabout 10 hours ago
Yeah I saw that. What do you mean 30 years in prison solely for the so called

"Corrupting and concealing documents, interfering with their ability to be used in grand jury and criminal proceedings; Conspiracy to conceal documents that would implicate Maricela Rueda"

By removing people from the Signal group?

garyfirestormabout 22 hours ago
I don’t think courts care about technicality here. They’re going to simply ask “why didn’t it unlock like a normal phone does” -> aka you’re deliberately hiding evidence from us.

I’m sure this case will be dropped because it will open bigger can of worms and may jeopardize the current practice of warrantless invasive searches at the entry points. Secretly I hope this goes to Supreme Court and once and for all they clarify on “constitution doesn’t apply at the border” piece of thinking

RetroTechie1 day ago
Sounds like a good reason to use alternatives like GrapheneOS. It doesn't take a big % of users to let the "using it is suspicious by itself" nonsense wear off.
Cider99861 day ago
It's already supported by Roblox:

https://news.ycombinator.com/item?id=48994716

2 days ago 87 comments

delfinom1 day ago
Not to worry, but big tech and government are slowly crafting laws that make non-big-tech operating systems illegal in the name of protecting children.
1attice1 day ago
Quick reminder to my fellows that if you discuss this story here, it will end up immutable and available to law enforcement and, e.g., H1B eligibility deciders.

Dark forest

wbl1 day ago
Better to die on ones feet than live on ones knees.
1attice1 day ago
Some of us are on visa and have our online presence routinely scanned these days. Asymmetric vuln. If that's not you, why are you upset when it is acknowledged?
ThePowerOfFuetabout 22 hours ago
Have you considered living somewhere the Sword of Damocles does not constantly hang over your head?

Most of the EU is lovely.

ImJamal1 day ago
It looks like there are a lot of issues here on the government side, but it also appears like the protestor intentionally gave them a password that, when used, wipes the phone? That seems like a clear example of destruction of evidence.
JumpCrisscross1 day ago
> That seems like a clear example of destruction of evidence

If he was under arrest, sure. The cops claiming this was a routine airport inspection would seem to muddy the waters, at least.

bootlooped1 day ago
I don't think the crime of destroying evidence / tampering with evidence depends on what your status in custody is. If the police knock on your front door and you start shredding documents, that's still a crime.

Now, could that get tossed about because they denied him access to a lawyer? Maybe, I don't know about that part.

JumpCrisscross1 day ago
> If the police knock on your front door and you start shredding documents, that's still a crime

Isn’t the relevant bit whether you think you’re doing crimes and/or being investigated?

If I’m shredding while the cops knock on my door because they’re looking for a missing cat, that’s obviously not criminal. (I guess the more-pertinent comparison would be they knock on my door and then I put stuff in the shredder while I check around my home.)

ImJamal1 day ago
Under Georgia law (16-10-94) you do not have to be under arrest.

> A person commits the offense of tampering with evidence when, with the intent to prevent the apprehension or cause the wrongful apprehension of any person or to obstruct the prosecution or defense of any person, he knowingly destroys, alters, conceals, or disguises physical evidence or makes, devises, prepares, or plants false evidence

woodruffw1 day ago
This would be under federal law, not Georgia law I believe. But even assuming it was under Georgia law: it hasn’t been entered into public evidence that the person in question knowingly destroyed anything. It’s entirely possible the phone had nothing of value on it; the prosecution is required to demonstrate that evidence was in fact destroyed or falsified.
kmoser1 day ago
It's too bad GrapheneOS doesn't support hidden volumes.
Cider99861 day ago
It can't because it runs on phones which only have SSDs which leave forensic traces. They would like to improve deniability but it must be robust, whatever they implement.
snypher1 day ago
Why do you think reporters would rather eat a contempt charge vs throwing their sources to the wolves?
kelseyfrog1 day ago
Technically that means the cops destroyed the evidence. Their investigatory department should be savvy enough to avoid destroying evidence.
ImJamal1 day ago
That is not how the law works. Under Georgia law (GA Code § 16-2-20) it says

> (a) Every person concerned in the commission of a crime is a party thereto and may be charged with and convicted of commission of the crime

>(b) A person is concerned in the commission of a crime only if he: (1) Directly commits the crime; (2) Intentionally causes some other person to commit the crime under such circumstances that the other person is not guilty of any crime either in fact or because of legal incapacity; (3) Intentionally aids or abets in the commission of the crime; or (4) Intentionally advises, encourages, hires, counsels, or procures another to commit the crime

Seems like this is a clear case to me.

kelseyfrog1 day ago
One weird trick to destroy evidence without creating a crime. Cops don't want you to know.
verdverm1 day ago
You do not have to give them your pin, by law. They can use biometrics to open your device, which is why you should not use biometrics for device unlocking.

GraphenOS has a couple of settings, a distress pin that wipes the device, and a number of failed attempts that will wipe the device. If the person handed over their "pin", they didn't need to