Notes ·
A Duress Password Is Now Being Treated as Destruction of Evidence
Zack Whittaker reports for TechCrunch, via Slashdot, that federal prosecutors have charged an American who allegedly entered a GrapheneOS duress password while Customs and Border Protection agents were attempting to search his phone.
GrapheneOS allows someone to configure a secondary password that irreversibly wipes the device when entered. It is designed for situations where the owner is being forced to unlock the phone. In this case, the government is treating its alleged use as the destruction of property to prevent its seizure.
That creates a troubling collision between privacy software and evidence law. A security feature intended to protect someone during coercion may now expose them to prosecution when it works exactly as designed.
The legality of the underlying search is also disputed. His attorneys say agents had no warrant, refused repeated requests for a lawyer and used the border inspection as a pretext for a broader investigation. The court has not yet resolved those claims.
Privacy tools are not inherently evidence of criminal intent. This case could help determine whether activating one under government pressure is treated as exercising control over your own data or as a federal crime.