Felony charges for citizen deleting phone data at US Border

It's a very insidious, first you look all over your neighborhood flock cameras Hundreds of them came out of nowhere Nobody fought back .

it's as long as you're not doing anything wrong you don't have to worry about it Then once changed the definition of what wrong means.

If you're not a criminal you don't have to worry about it That's for your safety Then they changed the definition of what a crime is

its only with the benefit of hindsight (and being on the winning side- thus the propaganda was never dispelled) that we consider the stasi and so on the way we do.

If it walks like a duck, and quacks like a duck.. might just be a duck.

I don’t believe those living “normal lives” in East Germany or the Soviet era considered the police to be evil and invasive the way we do today.

> this is a wild take

It’s a lazy, complacent take.

I mean its so much easier to do stuff the Stasi could only dream of with technology today.

> what the Stasi was doing

the stasi were spying on people and putting them in jail. what exactly is your claim about the difference? is it a difference in distinction or a difference in degree?

What makes you qualified and informed of what’s taking place to determine that?

What we hear about is far from comprehensive, and many of the atrocities won’t be unveiled or investigated until the next decade.

The Epstein cover up shows they’re used to keeping secrets.

I’m not sure why we’re pretending there’s not a convicted felon in charge of the entire system.

It just takes a bit of reading about American history to know that we have had authoritarian phases pretty much since our independence. John Adams and Thomas Jefferson policies against freedom of speech, native Americans and international trade, Fillmore and Buchanan fugitive slave act and Dred Scott, Lincoln suspension of Habeas Corpus, Cleveland using the military against unions, Johnson military expansion in Vietnam, Nixon secret bombings and using CIA/FBI against protesters. The nation was heavily polarized during each of these periods as much or more than it is today.

America dominance on the world is ending, it's a fact. East Asia is at least on par, India is china from 25 years ago.

It's becoming more obvious every day. And yeah, people in 1910 watched Europe dominate the world for about 1500 years. Yet it came to an end.

If you want to Speedrun the collapse, vote for trump. He sure is making a good job right now with diplomacy, lack of long term planning and just getting all your allies to hate you.

Interesting you say that, because as another Canadian, I would say that the sentiment in our country is the opposite of you describe. The actions of our government reflect it.

Canada is moving further from US, not closer. Canadians who support Americans are in the minority at the moment.

I'm not sure how a new US president would be able to turn it around.. further more, what's to say that the president thereafter will follow suit? How about the next 5?

> I don't think America can lose

It has already lost. America lost in Vietnam. Lost in Afghanistan. Turned Middle East into a humongous mess. Now losing badly in Iran. The only "wins" it had were against Countries where odds were already heavily in its favor (in other words invading tiny countries that did not have the technological wherewithal or the will necessary to fight back).

> 10y later they're richer than ever

The rich are richer than ever yes. Ask any common American citizen and he/she will come chasing after you for saying this.

> its companies have global dominance of the most world-changing technology of the last 20y. I just don't think "the collapse" is coming anytime soon.

That dominance is fast eroding. America itself has ended globalization. It is retreating from many crucial positions: like when it comes to cross-border payments, protecting freedom of navigation in high seas, deals that it had previously negotiated with all countries of the World, unable to protect allies in the Middle East and even in South East Asia, not delivering on defense commitments with partner nations... the list goes on and on.

> If anyone's interested in a friendly wager, my email is open. I'll happily go 1:1 odds that America will have a new president come 2029 and the country will still remain the world's richest and most powerful.

None of us believe America will collapse by 2029 and that there wouldn't be another President (unless Trump is really stupid enough to go down that route which I don't think he will). But by 2045? Yeah absolutely is possible.

Most major industrialized nations have gone through something like this and it usually takes much longer than 10 years to escape and correct.

Your day to day is still pretty much normal. If you turned off the news and never read about Felony charges for citizen deleting phone data [1] you'd just in your head remember there are tens of millions of folks flying, going through customs and border security and all that with 0 issues. What you wrote I think regarding the decade of silliness precisely supports the point, in my opinion.

[1] I'm not defending the behavior of border control here, but I also don't think we need to overreact to this one example which is exactly what is happening.

> some level of normalcy

You are undoubtedly correct that at some point there will be new leadership in the US.

Politics makes leadership change a possibility. Biology makes it an inevitability.

But I don't think the evidence is very strong that switching from one man to a different man, even if the new man wears a blue hat instead of a red hat, will make that much difference against capital and its surveillance state.

This isn't a false equivalence "both sides" argument. I'd greatly prefer the blue hat over the red hat.

But the blue hat only makes the underlying forces of late capitalism a little slower and a little less vicious, while simultaneously legitimizing that system.

I'm skeptical that we will have an exchange of power in the next 40 years.

The USSR is a great example: it took 65 years to fall, and the collapse didn't bring it to anything particularly good.

I agree. It's actually quite insulting to other countries whose actual atrocities were measured in lives lost. I voted for Kamala but Trump Derangement Syndrome is real. He's just a loser, he's not even remotely brave enough to be Hitler Jr.

The guy doesn't have the stomach for real totalitarianism. Just populism, corruption, and weakening the country.

>but the tick-tock has always ticked further towards a freer, more equal, and more equitable society.

This is a popular sentiment, not a statement of historical fact. Arguments both for and against this are credible.

Doing nothing is surrender. So what do you propose people do? What are you doing? Is it effective?

From the article:

“ he has been ensnared by National Security Presidential Memorandum-7, or NSPM-7, a sweeping directive issued by President Trump last September that expanded the definition of domestic terrorism to include crimes like getting in the way of immigration enforcement. His prosecution is one of the earliest known instances of the federal authorities charging a person with destroying evidence using a program designed to wipe a device clean after a specific code is entered.”

So, while “no privacy at the border” has always been a thing, the re-categorisation of this as “domestic terrorism” is new.

I agreed with everything you said up until “he’ll be convicted”.

Not a snowflake’s chance in hell unless the DSA metaphorically push the doddering old guard down the stairs.

Tens of millions have voted for this 3 times in the past 10 years, it succeeded twice. This is not going away, half the voting population of the US wants to live under authoritarian rule and will do anything to take the whole country with them.

Does anyone on the other side have a credible plan to undo the damage?

Where's the Project 2028 book?

Is there anyone credible putting together the Executive Orders to undo the stack of shit, is anyone putting together a short list of District Attorneys to interview on January 21, etc?

On a long enough timeline, nothing is permanent. The question is how long it lasts and how bad it gets before it gets better.

In terms of the ending, East Germany was nearly an ideal case. The state just sort of gently fell over. The country got absorbed into a friendly neighbor. There wasn't much loss of life, no widespread destruction.

Then there's East Germany's predecessor state, which ended because it decided to wage war on half the world, and its people bore the consequences. Millions dead, cities wrecked, occupation by foreign armies, the country carved up. "This too shall pass" isn't always a good thing.

Or look at the state that created and sustained East Germany. Borne out of violent revolution, decades of repression, collapse, turmoil, economic hardship, brief flirtation with democracy, de facto dictatorship, no end in sight.

My biggest worry with the US right now isn't the government itself. It's that so many people want this government. Voting doesn't help when the voters want the bad stuff. We could have a very different government in another two years if the people want it. I'm not convinced they do. If they do I'm not convinced that sentiment will last. We already went through this once, and the "actually, let's not give the shitheads power" sentiment fell apart by the next election.

> Tell me how you think East Germany is doing these days.

> And no, it doesn't have to take 40 years to right the ship, so long as people get their heads out of their asses and vote.

so then you admit the outcome here is contingent/conditional. do you understand that means we are already in dire circumstances if the outcome isn't certain?

This is a half-truth. In a full banana republic, technical compliance with the law will not prevent consequences for failing to do what the authorities want. In a jurisdiction with perfect rule of law, it always will. The USA is somewhere in between.

One of the laws that's enforced pretty well in the USA is the protection against unreasonable search. Most of the time, a search requires showing a judge evidence that the search is more likely than not to reveal evidence of a crime. Exceptions are narrow and specific; the government's options to punish someone who refuses to decrypt data at the border are limited to brief detention and seizure of the medium.

Not yet tested is the idea that erasing data on the spot satisfies the purpose of the border search exception, which is to prevent importation of things that are illegal to import. This case might address that question.

Normally I agree, but making the implementation initially ineffective is a good way to complicate more far reaching measures.

Americans aren't standing up against this, but they might have considerably more interest if the government was instead trying to ban encrypting data in cloud storage for everyone.

There's also just the fact it's ridiculous I can't have a spare phone ready to go in a few minutes and get it back exactly as I left it.

Yes, trying to solve a regulation or legal issue by some technical workaround will never work, you have to fight it at the same level, legally, or system-wise, otherwise, you will be like the person who tries to wash the stairs from the bottom all the way up, it rarely works, you gotta go up to down, collectively go against the matter rather than individually duct taping it for your own specific needs. In that example, it won’t be far fetched the same ones who made it illegal to wipe your phone to make illegal to install xyz OS or using abc protocol, in fact, that’s exactly what they are trying to do under the disguise of “protect the kids” and going after encryption or similar privacy related issues.

What about banking apps and stuff? Does the device binding still work or do you need to set it up again?

An increasing portion of phones are eSIM [0] only these days, and the difficulty of swapping can be weirdly-bad depending on provider.

[0] https://en.wikipedia.org/wiki/ESIM

As I understand it, the drive can thus be seized, and a potential loss of a cheap flash drive is a lower inconvenience than loss of the phone.

Tyranny does not care about "proof".

It doesn't even care about plausible deniability.

Best you can get away with is lack of suspicion. Have a secondary phone with some standard apps on that you use now and then so theyhave a history and just look like you are just not a technical person and read novels on dead trees instead. A lot of work but likely works.

The best technical solution is one code opens to a phone that has things but isn't your actual phone, and then another code that opens to your real phone.

Have you considered "no password set"?

>What is the difference between giving them a password which wipes the phone and giving them a password which opens a blank phone?

They don't get any indication that there was data there to be deleted, and you don't just factory reset but flash w an image of a clean phone that's been used. It has apps, it has accounts, it looks to the untrained eye (because that's who's looking at it) like a phone that was used normally by someone who has done nothing wrong.

Apple makes this very easy. I broke an iPhone and bought a replacement. If you have iCloud, you login to the new phone and you can see which backups you can recover from. If you are transferring a phone, say you upgraded, it’s even easier. You can also image the phone with a connected laptop and store it on a backup drive, which is nice to not use up iCloud limits.

The transfer and backup system are pretty much the same mechanisms.

Restoring is probably order of ~1 hour to go through all the setup. Then some hours to sync any data and updates that need to be redownloaded, apps reinstalled, etc.

Oh hey, I like this variant! So... both the BLE beacon and the phone have a faraday cage, and if they ever appear together outside their cages, the phone wipes?

Perhaps less likely to go wrong than my original proposal when living normal life, as it might wipe if the BLE signal randomly gets lost.

It would be nicer if you could leave phone in cage during security, and remove beacon while loading airport trays ("remove all electronics from their cases..."). the only chance for a failure mode is only when you're going through security, and have the fob outside its case..

But you'd need to be able to leave your phone in the faraday cage pouch while going thru security, which is only ok if they don't notice... (maybe they commonly don't notice small faraday pouches aren't empty... Maybe they wouldn't if you had a secondary mobile device...)

This depends on the beacon being visible. If they just take the phone and walk away, because that's where they think the evidence is, it won't wipe.

> If you're ever searched (or otherwise indisposed), they'll open the bag and wipe your phone for you.

Isn't that the exact same situation here that resulted in felony charges? Border agent was given a duress PIN and wiped the phone for the owner. Now owner is charged.

Ah I recall I used to see the creator around :) thanks for your work!

Regarding the motivation for usbkill mentioned in the article: I too was motivated to think on this stuff in relation to my sense of injustice around Ross Ulbrecht, and wanting to think of some way that someone in his position could avoid getting caught. One creative variant in my thinking involved embedding the BLE beacon inside a rubber ball that could be launched and lost track of. Or maybe embedded in heel of a shoe and ditched in transit haha

US law enforcement is well aware of it.

They're also now well aware of the GrapheneOS duress PIN/password feature. It was designed to work against an attacker aware of it by acting as a deterrence. If they're aware of the feature, it discourages them from trying to coerce a PIN/password and attempt to unlock with it. We aren't fond of features depending on an attacker being unaware of them and this isn't one of those.

Pixels have a high quality secure element enforcing a maximum of 20 unique attempts to derive the encryption keys for each separately encrypted profile. There's also very aggressive rate limiting between the attempts. It filters out duplicate attempts by temporarily remembering the previous 5 unique attempts to make the rate limiting more usable. A misremembered PIN/password repeatedly entered over and over will only use up 1 attempt.

Android does have standard support for enabling wiping after N attempts and an open source app can be used to set a configurable limit rather than specifically after 10.

If you're using roaming on your cellular plan, all your traffic is routed over VPN to your home country, so local blocks don't work.

(That's one of the reasons why it's trivially easy for foreign visitors to China to bypass the Great Firewall.)

If you were on wifi, that's notably interesting.

Then you probably had a home country IP and they filter based on IP.

> So you should be safe, apart from some kind of rubber-hose cryptanalysis.

There are vendors that sell the technology to adversarially access phone data, the "Before First Unlock" is the safest state a phone can be, but it's not infallible. The safest option is to have a burner or factory-reset phone with nothing on it, even if the hack succeeds.

> Then it needs a pin

A compromise to this is that many phones have a "lockdown" mode, where it isn't fully off but refuses to accept biometrics until a code/pattern is used to bring it to a more day-to-day mode.

It's less-secure than being fully off, but it also means if you do need to access your phone you can do so more-quickly.

If you don't give a pin, they can seize your devices (Andrew Tate on his 1st visit to Florida said that he refused to give pin and they seized phone and laptop)

If you’re a U.S. citizen: CBP cannot deny you entry to the United States merely because you refuse to unlock the phone. If you’re a non-citizen seeking admission: refusal is much riskier.

The important wrinkle is that CBP’s published policy expressly guarantees that a person being admitted as a U.S. citizen won’t be denied entry solely because CBP couldn’t inspect the device. It doesn’t give lawful permanent resident (green card holders) that same explicit statement. Instead, it says refusal by a “foreign national” can be considered in an admissibility determination.

You are correct, you have to give up the phone but can't be compelled to give up the password, and you'd get it back some indeterminate amount of time later.

It's actually been on the books for a while (decades at least) that customs can search you at the border without a warrant even if you are a citizen.

This case seems to have become a big 'Trump bad' poster child (people are calling the US East Germany in these comments...), but if this exact scenario happened at least in the last two decades (I found an example upholding the searches from 2004) then it would at least be possible to charge them with deleting evidence. Even this probably would have been nothing if he refused to give up his password, not being required to provide a password has been upheld for years. They can seize your phone for some time but I'm unsure on the times they ask and then just let you move on when they find out your a citizen.

Just get a boarding pass from the counter old school style. They still print them.

That's probably a bit overkill. TSA doesn't have nearly as much power as CBP, so it's only a concern when coming back across the international border.

the best decoy is a cheap burner phone that you only use for travel purposes

I'd guess the smiley indicates that op meant it as a joke.

Yes. Because law enforcement assumes there's bombs in boxes by default and defers to the bomb squad to understand the box before they touch it.

Why would the bomb squad trust the box owner to help them defuse it? To understand the issue, you have to construct a proper analog.

This discussion was raised last time this story was discussed. I was among its advocates: <https://news.ycombinator.com/item?id=49061890>.

Briefly: no.

Less briefly: <https://news.ycombinator.com/item?id=49060780> and <https://news.ycombinator.com/item?id=49060716> (from the grapheneos HN account directly).

Maybe it could cause the phone to "randomly" bootloop or something? "Oh no, my phone is broken again, last time this happened I needed to do a factory reset"

> I wonder whether it'd be better for a duress PIN to delete existing data

Reliably deleting data at the scale of the whole data partition, a secondary user or a Private Space is fully supported but requires a reboot or shutdown to truly complete it.

After wiping key derivation material needed to obtain the key encryption keys in multiple ways and wiping the encrypted disk encryption keys, the OS can still access the data. It still has data in the page cache, in registers and elsewhere. There are still a bunch of system processes with data tied to what was removed. The OS is still fully functional after the nearly instant wipe of everything needed to recover the data again. It can still access all data other than what's encrypted with hardware keystore keys and not currently decrypted.

The wiping process for the duress PIN/password is completed with a shutdown which tears down everything, zeroes memory and provides at least a small time window where the hardware is powered off too. A reboot would also work and the boot process has explicit zeroing of memory, registers, etc.

We decided to use shutdown for the duress PIN/pasword but a reboot is a valid approach too. Our locked device auto-reboot timer feature we first shipped in 2021 relies on the zeroing done by GrapheneOS for both the process of the OS tearing down and then again during booting to return the device to Before First Unlock state.

> also create a semi plausible artificial profile to hide the deletion event.

It isn't feasible to fool forensic software so it largely wouldn't work against state actors. It nearly certainly wouldn't have helped in this situation in the news. They aren't reliant on a non-technical person sifting through a phone. They'll just hook it up to a laptop and follow the data extraction procedure which involves enabling ADB. The software is aware of GrapheneOS can guide people through dealing with anything different about it. They've had a lot of trouble with extraction via ADB for GrapheneOS since the vulnerabilities they exploit via ADB keep getting patched or blocked it exploit protections but it isn't realistic to block extraction with them having the PIN/password. They could just enable the encrypted backup service in the OS instead and then use CLI tools to extract the data from there with the seed phrase. They don't do that because they want everything rather than only nearly all app data. They also have special code to deal with apps such as Signal with their own layer of data encryption since the data taken from their app data directory is nearly all useless by itself.

There's also quite a difference between wiping and rebooting into a not very plausible environment with decoy data set up by the user in advance compared to not properly wiping and giving access to a decoy profile. Bear in mind the OS can still access nearly all data after the wipe until a reboot. It could make a best effort attempt at purging as much as possible from memory, but the OS is not designed to continue functioning with all of the data disappearing. It can't just wipe all loaded encryption keys without crashing and rebooting anyway. It also has a ton of data still around in caches and elsewhere. We don't want to just do a best effort job cleaning up as much as we can but rather reliably prevent recovering any of the deleted data.

We could definitely add a duress PIN/password which wipes only specific secondary profiles, reboots and has the device still functional with whatever data was in the main user still there. That's a feature we can add, but it's important to note that it will not hide that there was deletion of data. It's easy to detect, and it's not feasible to hide that it happened. Many steps can be taken to make it less obvious, but it will still be easy for software aware of it to detect. Even a massive overhaul designed to perfect it would not address the SSD itself giving away what happened for more advanced analysis.

We aren't going to add a decoy profile compromising the security of the device and providing a way to recover data in a state where it isn't at all unrecoverable yet. We did already plan to consider a 2nd duress PIN/password which only wipes specific secondary profiles, but we need to make it clear that it cannot stealthily wipe them to users.

Or put a dead man's switch on there

I mean, it sounds like it would be even better if the duress response was more subtle.

A duress code might let me wipe my phone when someone holds a gun to my head and demands I unlock it. Problem is, there’s still someone holding a gun to my head.

Yes if you don’t mind getting arrested by our fascist border police

He’ll just have to pray the scene wasn’t recorded and his real PIN was one digit off

>I don’t think that would fly as a defense in court

but that's not the point, the point is to not wind up in court by presenting a phone that no long contains evidence but seems plausibly like your phone so doesn't arouse suspicion

From https://arstechnica.com/gadgets/2026/07/activist-charged-wit...

> Tunick provided this code to an agent, who entered it on the phone, after which “the screen went blank, flashed several times and the phone appeared to restart.”

So the real problem in the end is that your duress system should not put a big message "erasing all data" but "loading" slowly and just look mostly empty.

There is a difference between exploding a bomb and deleting your data. One is a crime.