US citizen charged after GrapheneOS phone wipes during airport search
techspot.com980 points by eecc 16 hours ago
980 points by eecc 16 hours ago
I co-wrote a border search guide for EFF some years ago. I was very interested in finding clever technical approaches but I later ended up feeling that I hadn't given enough thought to the overall threat model questions (even though the guide did address them, perhaps even somewhat usefully).
The big picture problem is that the agents performing the searches have an enormous amount of power in terms of potentially seizing devices and potentially denying entry for non-citizens. I think they should not have this power, but the agents and courts probably don't care that I think that.
The end result (not inherently different from what we wrote in the guide) is that you may have to think both about protecting your data by technical means, and about not angering the agents more than you plan to. I was fascinated by techniques for being unable to comply (which is straightforward to achieve if you want!) but probably didn't think enough about how much this might antagonize border agents in many cases.
I definitely don't know a comprehensive big-picture solution.
> you may have to think both about protecting your data by technical means, and about not angering the agents more than you plan to
That's the same problem with technical solutions to crime.
I come from a very dangerous city and I used to have a car that needed a PIN to work. You could turn then engine on and drive but after a minute if you didn't input the PIN it would turn off without warning and start blasting the alarm. The idea being that if the car was stolen the thief would be stranded not far from home unsure about what's happening. Great technical solution but it ignores that a lot of the time the car is stolen with you in it (in a kidnapping, for example). Having the car shutoff in the middle of a highway next to a panicking guy with a gun and trying to remember a PIN is not a situation you want to be in, so I just had the PIN number written down on the dashboard, which worked very well when I was eventually kidnapped and just pointed at the piece of paper with the number.
As one does. Why, six of the eleven times I've had my car stolen, it was a carjacking with myself or my family member in it.
Six of the eleven times...
Crazy.
What city was this, if you don't mind me asking?
In phone terms, that's the $5 wrench problem. The elaborate tech is not relevant if you can be simply coerced somehow to bypass it.
Again in phone terms, maybe bring a blank phone through that border.
And there's the problem that if the PIN or worse a biometric version of this becomes remotely well known you've now created an incentive for a car thief to kidnap people even if they only want the car.
Why are you staying in this place?
(Is this in South Africa?)
Brazil maybe?
Iceland I think
Washington most likely
I live in Washington DC, and even though carjacking is a problem here, not to a degree that people plan on it happening to them. I would be surprised if OP's situation took place in DC.
Carjackings ramped up in 2021 through 2024. They appear to be headed back down the "low and steady" of the early 00s. Looking at the numbers, DC isn't alone in this trend - Chicago was pretty bad as well.
I think in these situations your absolute best bet is fawning compliance. Ask precisely how high they want you to jump.
Perhaps your friendly smiling Yes-Sir-No-Sir-3-bags-Full-Sir act might just be enough to let you get on your way without anything else happening apart from a stamp in your passport.
Even the slightest hint of defiance or surliness from you to a border guard/policeman/etc - potentially at the end of a long shift, tired, angry, pissed-off or whatever - and you're straight away hugely more likely to have a bad day.
Finding strategies to "beat the system" will, I think, just be a shortcut to some other punishment/crime/taken-out-of-sight-and-given-a-proper-kicking-oh-they-resisted-and-went-for-my-gun/etc as this person found out the hard way by trying to be difficult.
I genuinely don't think there is a "get out of jail free card" or magic incantation you can say to get out of these situations apart from just smiling and being polite and not being a dick - if you get into a "who can be more annoying" competition, then the border guards/police will always win since they hold all the cards and will happily ruin your day/holiday/meetings etc by detaining you (its their job to do this after all)
There have been cases very recently in the US where the authority figures down dealing with the public are evidently in a very defensive, aggressive "us-vs-them" mindset, with an itchy trigger-finger to go with it. Don't be the person on the receiving end of a cop seeing-red because you're being a jerk.
The house always wins.
"If you want a picture of the future, imagine a boot stamping on a human face - for ever"
I will ask this here again:
At what point did the German people find it morally acceptable to start killing Nazis?
At what point will the US stop accepting the boot and act to remove the tyranny stamping on our collective face?
We probably need honey pod fake OS systems that boots up if not properly handled displaying some stars & stripes as background image and having the US national anthem playing for any sound the OS is trying to play.
A phone with a backup account, unlocked with duress pin makes sense to me.
How hard would it be to admin-allow some apps to work across barriers. E.g., wallet apps work, airline tickets work, but email/socials do not.
the issue is that when a phone is unlocked, they can just plug in a USB device and scrape everything off it. The TSA agent may not be eyeballing a facebook account so much as plugging in an exfiltration software stack or malware.
This would unironically probably work pretty well. The bullies in airports don't have that much time to investigate a phone which "looks good".
Don't forget to have the Official Social Media of the President of the United States(tm) installed, with an account following the correct list of truthtellers and rightthinkers.
I would prefer to backup and wipe my phone before travelling.
Then have some planned means of restoring the backup when it's safe to do so.
Being caught with a honeypot looks much worse than being caught with a new phone. You can always say you bought a cheap "travel" phone if asked.
It's hard to justify an iPhone Pro Max as a "cheap travel phone" though so you might actually need to buy a cheap travel phone.
Yeah, you really can’t outsmart those with physical power and authority over you. Americans have asked for, or tacitly accepted this treatment of their visitors. The only big-picture solution is to stop visiting.
> Americans have asked for, or tacitly accepted this treatment of their visitors.
Our citizens as well!
can you share the link? This?
https://www.eff.org/document/eff-border-search-pocket-guide
----
Seems the better strategy (for iOS) is come in with a plan to say yes to agents without pissing them off (like handing them an empty phone).
better to local back up, encrypt, upload to your home server etc.
Then login to a fresh iCloud account, selectively install apps, photos, and mail accounts. So it doesn't look like you're walking in suspicious.
This seems like an insane thing to have to do for visiting a supposed first world country. If phones had been around during USSR times I imagine you would have had to do the same. Personally I will rather just avoid any travel to the US, and I hope others do the same.
Security concerns you need to think about when visiting the US are absolutely no less than those when visiting China these days. Treat it like a totalitarian dictatorship with more technological means.
Nobody in China cares about your phone/laptop.*
*Unless you are (well) known dissident/journalisy/politician.
US is much more totalitarian than China. Lived in China for years, had multiple times various visa/residence permit issues with police and guess what, nobody cared about my electronics or was sending me to any detention, all I've got were quie helpful officers trying to find workarounds for me to deal with the situation.
Same thing on my last trin in summer 2025, we didn't stay in hotel, didn't go to register to police as you are supposed to and when crossing province border checkpoint guess what happened - they let us go to our tourist sight and told us to just register after weekend and as usual officers in police station couldn't care less, they just registered us without any issues.
You can complain about plenty things in China, there sure is a lot of bureaucracy but when you actually have to deal with them, they are pretty laidback and trying to be helpful usually.
By these standards and my experiences with registration in police stations in other two EU countries I can tell you China was the friendliest most laidback and convenient experience.
People who claim China is totalitarian dictatorship clearly never been to China and should get off their high horse, China nowadays make less trouble for their own citizens than EU hating them trying to make lives of EU citizens as inconvenient and expensive as possible.
Were you a Caucasian in China? Foreigners, particularly those from powerful Western countries, tend to get much more deferential treatment than locals.
Honestly, I personally would be less nervous visiting China.
Maybe marginally, but I'm still not visiting any county where I would be in trouble if the government/police knew my opinions of them. That's not just the obvious ones like US, Russia and China, but also countries like Thailand, Egypt, UAE, Israel to name a few. I like seeing the world, but not that much.
In China I would expect to be kicked out for having the wrong opinion as long as I didn't cause a big fuss. In the US I'd worry about being imprisoned.
China is known to hold Canadians on the excuse of being spies… spying for them is oftentimes filming without prior approval in non coastal but still civilian regions.
But weren't they... spies?
https://en.wikipedia.org/wiki/Detention_of_Michael_Spavor_an...
> According to a report by The Globe and Mail in November 2023, Spavor sought a multimillion-dollar settlement against the federal government for involving him in espionage activities without his knowledge. Spavor alleged that he provided Michael Kovrig with intelligence on North Korea, which Kovrig then secretly gave to the Canadian government and its Five Eyes allies without Spavor's permission, leading to their arrest and detention
Something I think is funny is that a lot of Chinese police think of themselves as catching up to the US in terms of surveillance tech. Think about how many internal migrant workers China has coming to the cities for work then back out to the rural areas.
This has become a running joke with a couple of the people in my office who have recently visited China (from the UK).
The next 2 years will be interesting for democracy as a whole.
China actually wants people to visit them and spend money.
And although I don't agree with the CCP ideology the Shanghai subway is ridiculously impressive.
Remember most of the Chinese train infrastructure was built in the time since the Hyperloop.
I was not impressed when I was sent there on business trip, from what I remember their subways were not as big as in Beijing or other CN places and I hit there my head, obviously anything is better than HK/London. Normally I'm not claustrofobic, but in HK subway...
I haven't been to the US since Trump first got elected, but even before that, immigration agents often seemed oddly adversarial, whereas immigration agents in China just don't really seem to give a shit.
From what I read about them (never had the honour and pleasure of interacting with one) it seems for some time they have had too much power with almost zero accountability and consequences.
I wouldn't say you are overreacting at all. I know someone who was detained for months on US soil after a phone search where the only "evidence" against him they found is illegal content sent by someone else to him on a group chat he doesn't even check. Had to get a lawyer and spend time in prison just waiting to be deported back.
What is illegal content in this context?
Jokes about Supreme Leader Trump?
(I'm not the person you replied to, I have no idea)
Jokes about Trump are rife in America, as are leader jokes in many Western countries. These are the last places you will need to worry about that.
You sure about that? https://www.theguardian.com/us-news/2025/mar/19/trump-musk-f...
Isn't Germany an exception to that?
At long as it doesn't involve [multi purpose eggs](https://www.euronews.com/culture/2026/06/06/mehrzweckeier-di...) or calls to violence you should be fine.