313
‘The Government Hopes To Set a Precedent’: An Interview With the Man Charged for Allegedly Wiping His GrapheneOS Phone (www.404media.co)
submitted 2 months ago by to c/privacy@programming.dev
72 comments fedilink hide all child comments
 

The U.S. government has charged Samuel Tunick with allegedly typing in a passcode to wipe his phone before officers could search it. “I hope people understand that the charges against me are meant to intimidate people,” he said.

Just another example of the Trump admin trying to intimidate protestors using whatever the fuck they can to bring up whatever charges they can.

top 50 comments

sorted by: hot top controversial new old
[–] 48 points 2 months ago (8 children)

I mean I think privacy advocates are looking to set a precedent. This case is perfect for us.

The officer was the one that wiped the data, so hopefully he'll loose his job. And they should be sued to pay compensation to the victim for the damages caused by lost data

  • permalink
  • fedilink
  • source
  • hideshow 8 child comments
    •
    load more comments (8 replies)
    [–] 38 points 2 months ago (20 children)

    What’s the charge?

  • permalink
  • fedilink
  • source
  • hideshow 20 child comments
    •
  • [–] 76 points 2 months ago (16 children)

    Destroying evidence, which is funny because that assumes there was any to begin with, which they can't prove.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 16 child comments
    •
  • [–] 36 points 2 months ago (15 children)

    That wasn’t the charge. The charge is destruction of property that the government is trying to hold on to.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 15 child comments
    •
  • [–] 16 points 2 months ago (1 child)

    But he did not destroy, officer did by type in code he got. His mistake to trust user.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 2 months ago

    I agree. I don’t think the charges will hold for exactly that reason, the device owner didn’t do anything to destroy the device and also didn’t prevent seizure. The CBP still has the device.

  • permalink
  • fedilink
  • source
  • parent
    • load more comments (2 replies)
    • [–] 20 points 2 months ago (18 children)

    Okay, new plan: instead of a duress password that deletes data, a duress password that randomly scrambles your decryption keys. (And of course all important data is already encrypted.)

    No 'evidence' was destroyed. The encrypted data is still there, perfectly intact. It's just that easy access to it has been cut off, since now not even you have a way to decrypt it.

  • permalink
  • fedilink
  • source
  • hideshow 18 child comments
    •
  • [–] 40 points 2 months ago

    nah, the duress should load a 'fake' account with dummy information and media. While deleting the real account in the background. What gave it away was the 'blinking' screen. Something that GrapheneOS team should be avoiding.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 29 points 2 months ago (11 children)

    That's actually what the duress password does and did here. Deleting the data would be too slow, so it gets rid of the keys instead.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 11 child comments
    •
  • [–] 10 points 2 months ago (10 children)

    I wonder; can those keys be backed up to a seprate device, and reinstated later?

    So: could you use the duress passcode to wipe the keys, making the device unreadable; then later use a backup to restore those keys and regain access?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 10 child comments
    •
  • [–] 12 points 2 months ago (8 children)

    My recollection is that the keys are stored on the TPM and can't be exported. Backups kick the can down the road; now the adversary demands access to your backups. If the keys can't leave the TPM and the TPM is wiped, then there is no more leverage that can be applied that will unlock the phone. The adversary might still try to get at other kinds of backups anyway to search for whatever data they were after to begin with, but that's a separate issue.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 11 points 2 months ago (4 children)

    I'm sure there's a difference between "I deleted evidence" and "I deleted evidence off this device you're inspecting without a warrant, you can have it with a warrant".

    But I also feel that unless there's suspicion of a specific crime, you can't really accuse someone of deleting evidence. And no, protesting peacefully is not a crime.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 7 points 2 months ago (3 children)

    In the US, they can't force you to give a password. Because they can't prove you haven't forgotten it.

    In this case, it was an officer who was attempting to gain unauthorized access to a device and then accidentally entered a code that caused it to wipe its own data

    So the activist has a pretty good case here to sue the officer for damages

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 5 points 2 months ago (1 child)

    Because they can’t prove you haven’t forgotten it.

    Technically, no.

    They can't force you to give a password because of court precedent around the 5th amendment. Courts ruled that being forced to give a password counted as being forced to divulge information and was thus a violation of your 5th amendment right to remain silent and not incriminate yourself.

    That's why they're still allowed to force you to give biometrics to unlock a device, though. Different court cases have ruled that being forced to put your finger on a fingerprint reader or show your face to a face scanner does not count as being forced to divulge information -- since it's action, not information -- so law enforcement is still allowed to force you to do those things.

    (Which means, if you're about to be arrested or you're crossing a border or something and you don't want your device searched, you should disable any biometric unlocking features first. I'm not familiar with Android, but in iphones, you can do this by restarting/powering off the phone (always requires pin/password on first boot) or by pressing the lock button repeatedly while already locked.)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    • load more comments (1 reply)
  • [–] 4 points 2 months ago (1 child)

    the keys are stored on the TPM and can't be exported

    Makes sense; if you can export them, so can an adversary.

    now the adversary demands access to your backups

    Only if they know/think they exist. The idea here would have been to make a nondescript offline backup of the keys and keep them totally seprate from the rest of your data/belongings. Possibly in a geocache type location.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    load more comments (1 reply)
  • [–] 3 points 2 months ago

    ... and that would require a search warrant. But then the highwaymen would have to go in front of a wigged political activist to seek approval of a search warrant. Baseless allegations by someone with dubious jurisdiction?

    Bet that hearing would never make it into the press

  • permalink
  • fedilink
  • source
  • parent
    • load more comments (1 reply)
  • [–] 14 points 2 months ago (4 children)

    The correct solution is a duress password that just opens a generic smartphone interface with nothing on it. Nothing suspicious. They won't even know to investigate.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
    • load more comments (2 replies)
    • [–] 20 points 2 months ago* (5 children)

    The charge is destruction of evidence because he used a duress password (he was legitimately under duress) to wipe the encryption keys off his phone, making it impossible for officers to do anything with.

    This was a violation of his 4th Amendment and 5th Amendment rights (4A is unreasonable search and siezure, while 5A is prevention of forced self-incrimination). Oh wait, the PATRIOT Act and Red Flag laws made 4A and 5A (respectively) defunct.

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] 3 points 2 months ago

    Technically he didn't enter the PIN. When repeatedly asked for it with no way to speak to a lawyer first, he gave them his PIN. Did they ask for his phone PIN, yep, did he give them his phone PIN, yes. Had they asked for a specific PIN for the device, they might have been able to get one specific to a profile on the device but they didn't.

    Did they ask him if this PIN was for a specific profile? Doubtful so it's kind of on them.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 17 points 2 months ago

    Turning this feature on right now, thanks for the reminder

  • permalink
  • fedilink
  • source
    •
    [–] 12 points 2 months ago (4 children)

    What happened to the fourth amendment

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
    • [–] 10 points 2 months ago (8 children)

    I don't really know anything about privacy and security in this context, but I remember playing around with encrypted disks and reading that encryption isn't really useful if your adversary knows that something exists albeit encrypted.

    I think this is similar: having a freshly wiped phone is going to attract attention. I'm not saying it's the wrong move in all cases, but it's probably the wrong move in the kinds of situations most people are going to encounter.

    I think the latest advice for attending protests and similar is to take a cheap burner.

  • permalink
  • fedilink
  • source
  • hideshow 8 child comments
    •
  • [–] 8 points 2 months ago (1 child)

    What we really need is deniable encryption, where you can decrypt just a specific layer of your device which is entirely innocent, while also possibly destroying the deeper layer which has anything incriminating. It's been a concept since the 90s, but it's not widely used or known of.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 2 months ago*

    Veracrypt can do this with hidden volumes. The danger is the hidden layer can look stable and fake so you need enough data that changes recently enough, and if you add too much to either volume it starts corrupting everything because one partition overwrites the other.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 7 points 2 months ago (2 children)

    The trouble here is that this happened to him in an airport, not during a protest.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 6 points 2 months ago

    for attending protests and similar

    Emphasis added.

    I remember reading warnings about having laptops and devices checked at airports a decade ago. As a matter of fact I think that's why I was looking into having hidden, encrypted partitions: because getting caught with some pirate TV series on my laptop might have meant having to pay a bribe or whatever.

    Regardless, it doesn't really change my point - if there's a chance you're going to interact with a government official and they might want to look at your device, wiping it is going to attract attention.

  • permalink
  • fedilink
  • source
  • parent
    • load more comments (1 reply)
  • [–] 3 points 2 months ago

    I mean, most people don't know their encryption keys. A correct password retrieves the keys from the TPM, the duress pin wipes the TMP so now even a correct password is unable to get any of the data.

    Hell, even if you use the same password in multiple locations (you shouldn't) a good service will salt (add a random but consistent jumble of characters for your account specifically) and then hash (weird complicated math that makes it really hard to reverse your password) your salted password then check if that salted hash matches what's on file.

  • permalink
  • fedilink
  • source
  • parent
    • load more comments
    view more: next ›