US Government targets Cop City protester over phone operating system | Hacker News Reader

US Government targets Cop City protester over phone operating system

theguardian.com

145 pointspastemato95 comments

"federal authorities had put him on a terrorism watchlist because of his alleged association with the movement against Cop City"

Talk about burying the lede

Burying the lede on what? The individual in question was being targeted in part because he was exercising his First Amendment right to protest environmental destruction and the militarization of police. I think if anything this makes it more disturbing. The US government has a long history of criminalizing movements they don't like as "terrorism".

You're agreeing with the person you responded to (bdcravens). Burying the lede means that bdcravens thinks the true headline should have been about being put on a terrorist watch list for protesting a police training camp, not about the phone.

Note that "antifa" is now recognized as a terrorist organization by the current federal government. It will get much worse if they aren't stopped.

which they are you referring to? Antifa or the gov't?

The Trump administration.

The answer I hoped for!

It's sad how much everyone saw this coming. We've been warned since the very beginning that this arbitrary expansion of punishments you can do to anyone labelled a "terrorist" (previous "communist") will inevitably come back to bite us. We saw it with the Red Scares and now we have the Black Scare. FFS, even citizens are getting arrested for moving zines around

Btw, here's a list of the zines for which people got charged as terrorists and sentenced for decades in prison for https://pnppl.cc/prairieland/

This whole thing highlights how insane US border law is.

Sam was physically in the US, but because he was on an international flight, he was arrested in a manner that would be unconstitutional anywhere else in the US. He was denied a lawyer, questioned for I presume hours, had his phone stolen without a warrant, and then was released because there was no crime CBP could figure out how to charge him with then and there.

Months later, he gets charged by a federal statute even though where he committed the crime was a place that federal law does? doesn't? extend. Apparently it's a very convenient place where the constitution is void but federal laws still matter.

Cops can't arrest or detain you without some articulable suspicion of a crime being committed. They can't steal your stuff to try and find a crime you committed. They can't search your phone without a warrant in which they provide a judge with enough evidence to reasonably suspect a crime has been committed.

Yet Sam apparently had no rights because he was put on a watchlist for exercising first amendment rights.

Very despicable behavior by the government and the federal prosecutors pursuing this case.

Indeed. Hopefully the next administration will hold current officials accountable for such abuses of power.

Yeah, and then they’ll give everyone a pony

It’s up to the people. If you can convince enough people this is worth voting for, you might accomplish something.

It is not always obvious how necessary it is to get involved in politics, even if it is inconvenient, as Mr. Tunick demonstrates. I’m not American and don’t live in the US, so, what I can objectively do is very close to nothing- my advice is pretty obvious and far from unique.

It seems many countries have a general low opinion of politics, as something dirty you shouldn’t engage with. We need to overcome that.

This problem pre-dates the current administration. Safe to say it has bipartisan support.

https://www.aclu.org/documents/constitution-100-mile-border-...

This is a technical problem.

Instead of wiping and rebooting, it should wipe while showing a lame spreadsheet application, or possibly a grocery list.

I don’t think a judge would be impressed by this. If anything it actually makes the legal case easier: there’s a legitimate use for a wiping feature on a phone (e.g. for theft or tampering), but actively producing false information demonstrates an intent to deceive or mislead.

Easier solution: phone wipes itself if passcode is not entered every X hours

Deadmans-switch, nice. I always had a weird fascination for that kind of mechanism, because it inverts the whole situation. Where before you have to actively wipe a phone, now them taking your phone may be the mechanism that triggers the wipe.

Is it legally better? Absolutely. But all they have to do is say "they did this as a legal workaround for that" and you're no better off, at least not without spending the same amount on lawyers. You can't out-tech your way around a corrupt system, they will find a way to get you.

if you have it running constantly, i dont think that argument can be made

id expect that youd be ordered to retain the data though, if an investigation is being done

Any argument can be made, and accepted by a judge, in a sufficiently corrupt system. Like the parent said, you can't out tech this because logic ceases to be applied to laws. It instead become heads I win, tails you lose.

Yes sure, given a sufficiently corrupt system nothing helps. Even being innocent and revealing everything won't help.

But this stance amounts to giving up. Within the wiggle room a system gives us there are still ways to widen cracks or attach a lever, however small they may be.

GrapheneOS already has an auto-reboot feature that can be set to time intervals ranging from 10 minutes to 72 hours. Rebooting puts the device back in before first unlock (BFU) state. This wipes all memory contents, including the encryption keys. Any unlock attempt will have to go through the secure element, which is basically impossible to tamper with (no successful attacks on the Titan M2 so far, or the Apple SEP for that matter), and includes substantial security mechanisms, such as throttling key derivations (through the Weaver API), or insider attack resistance (requiring user authentication before new firmware can be flashed to the secure element).

Leaked documents from mobile forensics companies, such as Cellebrite or XRY confirm this. It's impossible to crack a Pixel with GrapheneOS in BFU state. See https://grapheneos.social/@GrapheneOS/112462758257739953 and https://grapheneos.social/@GrapheneOS/112826067364945164

There's a problem with that too: it would often force the owner of the phone to input the code when outside a secure environment, so a simple video surveillance could obtain the code.

GrapheneOS has a feature to scramble the locations of the numbers on the passcode unlock screen to prevent this exact problem

That can be helpful only if surveillance cannot film the screen directly, and surveillance relies on the position of the fingers. Given modern 4k cameras it's unlikely the latter can be done but not the former.

You can also use a privacy screen protector. Or use the two factor fingerprint unlock, which requires both a fingerprint and a PIN to unlock. And that's only after first unlock, so you can still use a separate, strong passphrase for BFU state.

Sure, a privacy screen makes things a bit more difficult for surveillance, because the camera would need a line of sight at a low angle, but once the code is known, the attacker can force a fingerprint and input the code.

Deceiving a kidnapper into thinking you complied with their order to unlock your phone would be a legitimate use.

My RSA app accepts a PIN before it generates a passcode. If I enter the wrong PIN, it’ll generate a wrong passcode.

Do, I guess the cops will continue to beat me until I produce a valid passcode.

This feels like a rhetorical question but I'm not entirely sure. What do you mean?

It was just an observation of a clever feature of my security token, as well as one on how futile it is if whoever wants a real passcode really wants it.

Oh ok, I misunderstood! Ledger wallet has a similar feature where you can assign a decoy wallet to a pin code.

Or just don't wipe your phone and let the reboot timer do its work and bring your phone to BFU state, effectively uncrackable.

The issue here is CBP was (illegally) demanding he give them his passcode (5th amendment violation).

Doesn't really matter if the reboot timer is triggered if the thugs have beaten your code out of you.

There's an XKCD for that: https://xkcd.com/538/

Or turn your phone off while transiting airports. Not a catch-all solution in life, but considering the extra-lack of rights we have there, it makes sense. No need for them if you write down your confirmation number before arriving for departure, in order to get your ticket printed. On landing, have it off until you clear TSA and Customs.

It shouldn't be this way, but oh well.

At least disable biometric login.

Grapheneos has pin+biometric second factor as secondary unlock so it should be fine if you use that.

And fully disable the USB port (GrapheneOS-exclusive feature). This will make it impossible to extract data with mobile forensics software/devices (such as the Cellebrite UFED).

That would be a bad idea. GrapheneOS operates under the assumption that every attacker has encyclopedic knowledge of GOS at all times. This is by far not an unreasonable assumption. GrapheneOS does not add features relying on ignorance that they exist.

The duress wipe feature shuts the device down to let RAM discharge, this is an important step to remove any components of decryption before they can be lifted.

What about a duress timer working as the reboot timer but it wipes if you don't unlock within the time period. Would that have any advantages for destruction of evidence or deniability?

That would not be viable because the hardware does not support it. It cannot be implemented in the OS because the OS can be turned off or exploited endlessly.

For GOS to consider it, it would likely need to be backed by the secure element.

Duress PIN is deemed acceptable to implement in the OS because it is expected that the user is the one to enter it, so it has not fallen into the hands of attackers who may bypass it. Once attackers have it, you are effectively gambling. Account for that in your threat model and do not let it get to that point.

> This is a technical problem.

Government overreach cannot be solved with technical solutions.

Quick reminder to my fellows that if you discuss this story here, it will end up immutable and available to law enforcement and, e.g., H1B eligibility deciders.

Dark forest

Better to die on ones feet than live on ones knees.

Some of us are on visa and have our online presence routinely scanned these days. Asymmetric vuln. If that's not you, why are you upset when it is acknowledged?

Have you considered living somewhere the Sword of Damocles does not constantly hang over your head?

Most of the EU is lovely.

In America you can call politicians names. In Germany that's a criminal offense

I said _most_.

Also, a lot of us live outside the US and have no protected rights whatsoever when on US soil, at least according to the current regime.

So, I ask again: please, my American friends, fix the country. It’s a very nice one, I like it, and I miss visiting you. Your fellow contrypeople deserve better, even if this is what they vote for. I would love to be able to help, but I really can’t.

You have it backwards.

It is better to live on one's feet, than to die on one's knees.

Nope. You have it backwards. It is better to die on one's feet (being brave, and keeping your honor even if that means you dying), than to live on one's knees (living your life in fear and obedience).

Whooosh.

The technical problem here seems to be that GrapheneOS apparently doesn't support logging in to a partitioned empty OS for scanning purposes, also that it doesn't support such partitions at all, only one of which would be the real one.

It's not possible to create that feature because GrapheneOS operates under the assumption that an adversary has encyclopedic knowledge of the OS. Currently your suggestion would leave forensic traces so it wouldn't achieve the goal of deniability.

I find that line of thought to be hilarious and absurd, since even simple encrypted containers on mass-market Android devices work to shield the user. The forensic trace doesn't grant access to the container.

There's no problem with preventing access on GrapheneOS. It's one of, if not the most, secure operating systems for that purpose.

You said that there are no partitions. That's wrong. There are no hidden partitions, because they would be ineffective. You can have up to 32 user profiles with different unlock methods, and within them you can have private spaces which are basically the same as user profiles.

User profiles and private spaces are great because they can allow more of your OS to remain BFU, which is more secure than AFU. They are great for security, but they provide no plausible deniability.

>The technical problem here seems to be that GrapheneOS apparently doesn't support logging in to a partitioned empty OS for scanning purposes

Initially you suggest deniable partitions. I explain that it's not possible to achieve robust deniability that way, because it would leave forensic traces.

>since even simple encrypted containers on mass-market Android devices work to shield the user.

User profiles and private spaces are encrypted, isolated containers, and they exist on Android and are enhanced by GrapheneOS.

The forensic trace doesn't grant access to the container.

That is about security, which is already fine. We aren't talking about security; we are talking about deniability. Your suggestion to add fake partitions would not be effective for deniability because it would leave forensic traces. Deniability with hidden partitions is not currently possible on the flash storage used in Pixels and all modern phones, due to wear leveling and many other critical problems inherent to flash memory [1].

[1] https://veracrypt.io/en/Wear-Leveling.html

Are you saying that GrapheneOS has the means to allow a user to fully encrypt applications and their files? I mean while allowing login and access to the scanner where there is nothing to see.

> Initially you suggest deniable partitions.

That's nonsense because I never suggested a goal of complete deniability. You keep insisting I did, and attempting to bury the discussion on such grounds, but I never did.

>Are you saying that GrapheneOS has the means to allow a user to fully encrypt applications and their files? I mean while allowing login and access to the scanner where there is nothing to see.

No I did not mean that. There's means to fully encrypt applications and files, like on any modern smartphone. There's also user profiles and private spaces which allow you to separate your data and encrypt them differently. Notice "private spaces" and user profiles. There's no "deniable spaces"

There's no means to allow decryption while hiding data. The only deniability feature I'm aware of is the duress password.

>"Initially you suggest deniable partitions."

>That's nonsense because I never suggested a goal of complete deniability.

>"The technical problem here seems to be that GrapheneOS apparently doesn't support logging in to a partitioned empty OS for scanning purposes"

This is what a form of plausible deniability would look like. GrapheneOS isn't going to implement a non-robust plausible deniability feature.

>You keep insisting I [suggested a goal of complete deniability], and attempting to bury the discussion on such grounds

I never insisted that you suggested a goal of effective deniability. I only explained that GrapheneOS isn't going to implement a non-robust implementation of that feature, which is the only implementation that is technically possible right now.

The reason I'm emphasising an effective plausible deniability solution is because that's the only solution that would actually help anybody. It's also the only solution that would ever be implemented. A non-robust solution would give people a false sense of security and would therefore help attackers.

Honeypot operating systems like Anøm are the ones that hide the OS within a calculator. GrapheneOS is not gonna do something stupid like that.

I'm just informing you of the real landscape of the feature you want. I thought it was a nice thing to do.

This is a good article, and it brings much-needed attention to this case, which so far has not received the level of public awareness that is consummate with seriousness with which the federal government intends to weaken or undermine the First, Fourth, and Fifth Amendment rights of every American in prosecuting these bogus charges against Sam.

However, it makes an erroneous equivocation that, I believe, has profound technical and legal implications. In the article's first paragraph, it claims that GrapheneOS "enables users to enter a passcode and wipe a phone clean". What the author of the article is referring to is GrapheneOS's duress password/PIN feature[1], which does not (contrary to what it may seem on first glance) delete or modify the data on the persistent flash storage phone in any way. What it does is zero the key slots in the phone's Secure Element, which stores the disk encryption keys necessary to decrypt the data on persistent storage (technically, these disk encryption keys are not themselves stored in the secure element, but are first encrypted with a key encryption key/KEK derived from a user-entered passcode/PIN and then stored in the secure element[2]. If an adversary were able to break the secure element and extract the contents of the key slots, they would still need to brute-force the KEK in order to obtain the actual disk encryption keys).

To my knowledge, US law does not explicitly say whether deleting the key necessary to decrypt a given ciphertext is equivalent to deleting the ciphertext itself. Technically speaking, they are not equivalent, even if it would take an exorbitant amount of time to recover a deleted key using a brute-force search or some forensic method. If the federal government wants to claim, using this case to set a legal precedent, that it is equivalent, then I would argue that this in effect makes encryption as a concept illegal (as encryption is nothing without the ability of the person using encryption to control access to the encryption key(s)). Reading about the recent Prairieland trial, in which (among other blatant injustices) an activist was convicted by a kangaroo court of "destroying evidence" because they merely removed someone from a Signal group[3], it's clear to me that Prairieland along with Sam's case is part of a coordinated strategy under the NSPM-7 "Antifa Memorandum"[4]: the federal government is using lawfare to establish that it has a right to arbitrarily access the data of its citizens in order to crush political dissent.

[1] https://grapheneos.org/features#duress

[2] https://grapheneos.org/faq#encryption

[3] https://www.theguardian.com/us-news/ng-interactive/2026/jun/...

[4] https://en.wikipedia.org/wiki/NSPM-7

I don’t think courts care about technicality here. They’re going to simply ask “why didn’t it unlock like a normal phone does” -> aka you’re deliberately hiding evidence from us.

I’m sure this case will be dropped because it will open bigger can of worms and may jeopardize the current practice of warrantless invasive searches at the entry points. Secretly I hope this goes to Supreme Court and once and for all they clarify on “constitution doesn’t apply at the border” piece of thinking

I wish I shared your optimism. For the sake of the accused, I hope you're right, but I could see them really doubling down on this.

Yeah I saw that. What do you mean 30 years in prison solely for the so called

"Corrupting and concealing documents, interfering with their ability to be used in grand jury and criminal proceedings; Conspiracy to conceal documents that would implicate Maricela Rueda"

By removing people from the Signal group?

Sounds like a good reason to use alternatives like GrapheneOS. It doesn't take a big % of users to let the "using it is suspicious by itself" nonsense wear off.

It's already supported by Roblox:

https://news.ycombinator.com/item?id=48994716

2 days ago 87 comments

Not to worry, but big tech and government are slowly crafting laws that make non-big-tech operating systems illegal in the name of protecting children.

It looks like there are a lot of issues here on the government side, but it also appears like the protestor intentionally gave them a password that, when used, wipes the phone? That seems like a clear example of destruction of evidence.

Why do you think reporters would rather eat a contempt charge vs throwing their sources to the wolves?

> That seems like a clear example of destruction of evidence

If he was under arrest, sure. The cops claiming this was a routine airport inspection would seem to muddy the waters, at least.

I don't think the crime of destroying evidence / tampering with evidence depends on what your status in custody is. If the police knock on your front door and you start shredding documents, that's still a crime.

Now, could that get tossed about because they denied him access to a lawyer? Maybe, I don't know about that part.

> If the police knock on your front door and you start shredding documents, that's still a crime

Isn’t the relevant bit whether you think you’re doing crimes and/or being investigated?

If I’m shredding while the cops knock on my door because they’re looking for a missing cat, that’s obviously not criminal. (I guess the more-pertinent comparison would be they knock on my door and then I put stuff in the shredder while I check around my home.)

If you shred any evidence of a crime you are guilty of a crime regardless if the police ever knock at your door or you think you are being investigated if you have the intent "to prevent the apprehension or cause the wrongful apprehension of any person or to obstruct the prosecution or defense of any person, he knowingly destroys, alters, conceals, or disguises physical evidence or makes, devises, prepares, or plants false evidence"

You're jumping to conclusions.

Deletion to protect privacy does not prove deletion to prevent apprehension.

I could believe that everything is wholly innocent, but wish to protect privacy regardless.

If that was his intent he shouldn't have handed over any pin. This looks like he was hiding evidence of wrongdoing and he will probably be charged with it. I am guessing his only hope will be that they denied his request for a lawyer.

His rights were already being violated. He was falsely arrested and denied his rights to an attorney.

They can prosecute him (and probably will) but he's got a pretty strong civil rights claim against the federal government for a false arrest and illegal search and seizure.

You can't arrest someone without a warrant or a reasonable suspicion of a crime. These thugs had neither when they arrested him, just that he's "a terrorist". That's why they were trying to get him to confess or commit a crime. That's why they didn't want a lawyer to get involved.

What if I have a camera/microphone near my front door, that when law enforcement is detected, it auto wipes my data, with no interaction from me?

I don't think it ceases to be a crime if you automate it. What if instead of wiping data it set off a shotgun that was pointed at the door?

Under Georgia law (16-10-94) you do not have to be under arrest.

> A person commits the offense of tampering with evidence when, with the intent to prevent the apprehension or cause the wrongful apprehension of any person or to obstruct the prosecution or defense of any person, he knowingly destroys, alters, conceals, or disguises physical evidence or makes, devises, prepares, or plants false evidence

This would be under federal law, not Georgia law I believe. But even assuming it was under Georgia law: it hasn’t been entered into public evidence that the person in question knowingly destroyed anything. It’s entirely possible the phone had nothing of value on it; the prosecution is required to demonstrate that evidence was in fact destroyed or falsified.

> the prosecution is required to demonstrate that evidence was in fact destroyed or falsified

Is this legally true? At least in civil matters, destroying evidence typically causes the worst to be assumed about whatever was destroyed.

I thought the standard for obtaining adverse/negative inference in a criminal case was higher than in a civil one, i.e. a judge will typically need more than just evidence that information was destroyed. But IANAL!

Maybe you just get charged with destroying or tampering with evidence instead of the original charge? (Help us rayiner!)

He was in Atlanta so he can be charged with a Georgia law even if it was the feds are involved. The federal law is quite similar though so it doesn't really matter.

> Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed under title 11, or in relation to or contemplation of any such matter or case, shall be fined under this title, imprisoned not more than 20 years, or both.

I'm not a lawyer, but I think the federal law might be more damning since the law clearly doesn't state that there has to actually be anything of value on the device as long as there was "intent to impede, obstruct, or influence the investigation". Wiping a phone that they want to look at will impede the investigation.

Perhaps It had a message involving client-attorney communications? Is there any carve out for that case? Is that still intact or has a jack boot been applied to its throat?

You do not have to give them your pin, by law. They can use biometrics to open your device, which is why you should not use biometrics for device unlocking.

GraphenOS has a couple of settings, a distress pin that wipes the device, and a number of failed attempts that will wipe the device. If the person handed over their "pin", they didn't need to

GrapheneOS does not offer a feature to wipe the device based on failed attempts.

I thought I read about it in their docs, but perhaps I'm hallucinating that from a forum post requesting the feature.

It doesn't wipe after a certain number of failed attempts but rather the secure element only permits a total of 20 attempts and heavily throttles the rate those can be done. That's a standard feature for Android 16 QPR2 and later for devices implementing the recommendations. The list of devices with it likely currently only includes Pixels but we'll make sure to have it on the upcoming Motorola Mobility devices.

We wrote an overview of the features we provide:

https://discuss.grapheneos.org/d/40700-grapheneos-protection...

It's too bad GrapheneOS doesn't support hidden volumes.

It can't because it runs on phones which only have SSDs which leave forensic traces. They would like to improve deniability but it must be robust, whatever they implement.

Technically that means the cops destroyed the evidence. Their investigatory department should be savvy enough to avoid destroying evidence.

That is not how the law works. Under Georgia law (GA Code § 16-2-20) it says

> (a) Every person concerned in the commission of a crime is a party thereto and may be charged with and convicted of commission of the crime

>(b) A person is concerned in the commission of a crime only if he: (1) Directly commits the crime; (2) Intentionally causes some other person to commit the crime under such circumstances that the other person is not guilty of any crime either in fact or because of legal incapacity; (3) Intentionally aids or abets in the commission of the crime; or (4) Intentionally advises, encourages, hires, counsels, or procures another to commit the crime

Seems like this is a clear case to me.

One weird trick to destroy evidence without creating a crime. Cops don't want you to know.

Evidence of what?

Reply on news.ycombinator.com