Before you read this, make sure you understand this site's rules.

[KGIII]

So, a dude was in customs. They asked for his PIN to unlock his phone. He gave them the 'duress' PIN, which immediately rebooted and wiped the phone. This, of course, made them angry. It made them very angry.

US government targets Cop City protester over phone operating system

Concern over US effort to prosecute Sam Tunick, accused by authorities of wiping his phone using GrapheneOS

www.theguardian.com

Now, here's the thing. If you reply, you must be acutely aware that we do not allow any political discussion.

That's going to be difficult. I'm hesitant to even post this. If you can't comment without including politics, don't comment.

We'd be on the good side if the conversation was factual information about the laws in place. We might even discuss some of the legal strategies. But under no circumstances can we include politics.

I think we can do it, as long as we're careful. If I didn't think we could do it, I wouldn't try posting it.

This may come as a surprise to some people, but there's a certain distance around the United States' borders where not all legal protections apply. This also extends to international waypoints like airports that accept international flights.

I'll share this link:

Know Your Rights | 100 Mile Border Zone | ACLU

The Fourth Amendment of the U.S. Constitution protects people from random and arbitrary stops and searches. Although the federal government claims the power to conduct certain kinds of warrantless stops within 100 miles of the U.S. border, important Fourth Amendment protections still apply.

www.aclu.org

Again, I'm hesitant to share this -- but I think it is important as it talks about tech rights and it's about FOSS. GrapheneOS is Linux.

Moderation may be a bit heavy-handed in this thread. Do not cross the Rubicon.

 

[f33dm3bits]

So, a dude was in customs. They asked for his PIN to unlock his phone. He gave them the 'duress' PIN, which immediately rebooted and wiped the phone. This, of course, made them angry. It made them very angry.

Again, I'm hesitant to share this -- but I think it is important as it talks about tech rights and it's about FOSS. GrapheneOS is Linux.

I think it's a brilliant feature! I'm not sure how to word this without it sounding political but I'll try. Isn't it a human right in most western countries to not cooperate in your own prosecution in a situation described in the article that happened with the phone? So I don't think anything wrong was done by the guy having used this feature of his phone, no matter if he's guilty or not. I also don't think a feature like this should be illegal because then you open a can of worms for other similar like situations with different things.

 

[KGIII]

Isn't it a human right in most western countries to not cooperate in your own prosecution

On another site, I discussed some of the possible defenses. What you're describing is actually our 5th Amendment. You may know of it from movies. "I'm pleading the 5th!" But the Amendment is more than just that. The very basic part of the 5th that you're not obligated to help in your prosecution.

There are also some 4th Amendment challenges to be made (search and seizure requirements). There's also the definition of property. The prosecution must also prove intent. Again, the dude's not obligated to help them. His lawyer could contend that he just gave a random PIN and it wiped the device.

In the US, it's important to keep in mind the following:

They can make you do things, but they've long upheld that you have a right to what's in your head. If the phone was locked with a fingerprint or facial recognition, they can put your fingers on the phone or hold it up to your face. You're not obligated to give them the PIN.

They're not charging him for withholding the PIN. He could have done that. If he did that, Customs still has to let him in the country -- but they can seize his phone to do forensics on it at a later time. They're charging him for destroying property to hinder investigation by destroying evidence.

Hmm...

No politics...

Lemme think...

Before jumping to conclusions, be sure to know the laws your rights that apply to you in any country you live in or will visit.

And...

Much of this American legislation came from the PATRIOT ACT. I can mention that without offering an opinion on the matter. That's simply a part of legal history.

I changed some verbiage. Nobody can know all the laws of a modern country. You can have a basic idea of your rights in short order. You'll need researchers and a law degree to know the laws themselves.

 

[Brickwizard]

I wonder how many more people will now switch to open source now its been made public

 

[KGIII]

I wonder how many more people will now switch to open source now its been made public

Is it politics if I answer that with, "Well, I hope many people make that choice. Especially if they're not doing anything illegal."

 

[KGIII]

Also...

"If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him."

So, even if you're not breaking the law...

 

[f33dm3bits]

On another site, I discussed some of the possible defenses. What you're describing is actually our 5th Amendment. You may know of it from movies. "I'm pleading the 5th!" But the Amendment is more than just that. The very basic part of the 5th that you're not obligated to help in your prosecution.

They're not charging him for withholding the PIN. He could have done that. If he did that, Customs still has to let him in the country -- but they can seize his phone to do forensics on it at a later time. They're charging him for destroying property to hinder investigation by destroying evidence.

I think that's kind of odd charging for destroying his own property to enforce his 5th amendment right as what you call it there. If one can override the other, what's the point of having the 5th amendment anyways? That was more of a rhetorical question as, it might get too much into politics talking about that?

 

[//////]

duress pin sounds like a really nice feature.
but i wouldnt use one in a certain situations.

here at Finland yeah, i could use one but i dont have any reason to wipe clean my phone. except privacy.

 

[kibasnowpaw]

This is a legal grey area, but I would not recommend doing it. Deliberately entering a duress PIN that wipes the phone while customs officers are trying to search or seize it could be treated as intentional destruction of evidence or obstruction. In the United States, prosecutors may try to charge someone under 18 U.S.C. § 2232(a), which covers destroying or damaging property to prevent a lawful government seizure. Whether the charge would succeed depends on whether the search was lawful and whether intent can be proven, but triggering a wipe is legally much riskier than simply refusing to provide the PIN.

 

[KGIII]

If one can override the other, what's the point of having the 5th amendment anyways?

I can not give you the answer I want without delving into politics.

We'll have to see what happens in court. What's scary is that the US Federal Courts have a conviction rate of over 90%. It's estimated that 4% to 6% of people in American prisons are innocent. (Many innocent people are in jails because they can't afford to bail themselves out.)

Whether the charge would succeed depends on whether the search was lawful and whether intent can be proven, but triggering a wipe is legally much riskier than simply refusing to provide the PIN.

I'd never be dumb enough to have anything 'bad' on my phone while going through customs.

We'll have to see where this case goes. I'm interested in the outcome. Fortunately, they should have NGOs like the ACLU (and maybe even EFF) helping with their defense.

That said, I've never been asked to unlock my phone when going through customs. I make regular short trips to Canada, plus I've done a lot of other international travel. No country has ever asked to see what's on my phone.

I suppose that's pure luck. Then again, I sure as heck won't have anything illegal on my phone in the first place, and I darned sure won't have any on my phone if I'm crossing borders!

 

[//////]

Then again, I sure as heck won't have anything illegal on my phone in the first place, and I darned sure won't have any on my phone if I'm crossing borders!

yeah, but there is dumb people who get caught out in the border, and that means officers like to check out phones.

 

[kibasnowpaw]

I can not give you the answer I want without delving into politics.

We'll have to see what happens in court. What's scary is that the US Federal Courts have a conviction rate of over 90%. It's estimated that 4% to 6% of people in American prisons are innocent. (Many innocent people are in jails because they can't afford to bail themselves out.)



I'd never be dumb enough to have anything 'bad' on my phone while going through customs.

We'll have to see where this case goes. I'm interested in the outcome. Fortunately, they should have NGOs like the ACLU (and maybe even EFF) helping with their defense.

That said, I've never been asked to unlock my phone when going through customs. I make regular short trips to Canada, plus I've done a lot of other international travel. No country has ever asked to see what's on my phone.

I suppose that's pure luck. Then again, I sure as heck won't have anything illegal on my phone in the first place, and I darned sure won't have any on my phone if I'm crossing borders!

In case you didn’t know, if you care about keeping your phone private when dealing with US police or border authorities, I would not rely on Face ID or fingerprint unlocking. Some courts have ruled that forcing someone to use a biometric unlock does not violate the Fifth Amendment because your face or fingerprint can be treated as a physical characteristic rather than testimony. The law is still divided between jurisdictions, so it is not true that police can always force it, but a strong passcode generally gives you better legal protection than Face ID. Before crossing a border, I would disable biometric unlocking or restart the phone so it requires the passcode.

 

[KGIII]

yeah, but there is dumb people who get caught out in the border, and that means officers like to check out phones.

Yup. It's fairly common. Given the number of times I've crossed international borders, I'm probably a rarity in that I've never been asked to unlock my phone. I did have one customs agent look heavily at the case my phone was in, probably because it was bulky.

I would not rely on Face ID or fingerprint unlocking.

Yup. As mentioned above, they've decided that they can force you to use your finger or face, or any other biometric data. At the same time, the courts have long upheld the right to keep private that which is in your head.

It might be worth doing a combination. Say, both a fingerprint and a PIN.

I'm liking the idea of a duress PIN. I just don't see any reason to put the effort in. It's not something I'm likely to ever use. Any situation where I would use it would likely be a situation where they introduced a rubber hose to the discussion.

 

[kibasnowpaw]

Yup. It's fairly common. Given the number of times I've crossed international borders, I'm probably a rarity in that I've never been asked to unlock my phone. I did have one customs agent look heavily at the case my phone was in, probably because it was bulky.



Yup. As mentioned above, they've decided that they can force you to use your finger or face, or any other biometric data. At the same time, the courts have long upheld the right to keep private that which is in your head.

It might be worth doing a combination. Say, both a fingerprint and a PIN.

I'm liking the idea of a duress PIN. I just don't see any reason to put the effort in. It's not something I'm likely to ever use. Any situation where I would use it would likely be a situation where they introduced a rubber hose to the discussion.

you could do a simpler version that would be mush better type a pin code wrong 5 time or something and the phone wipe it self

 

[APTI]

I think it's a brilliant feature! I'm not sure how to word this without it sounding political but I'll try. Isn't it a human right in most western countries to not cooperate in your own prosecution in a situation described in the article that happened with the phone? So I don't think anything wrong was done by the guy having used this feature of his phone, no matter if he's guilty or not. I also don't think a feature like this should be illegal because then you open a can of worms for other similar like situations with different things.

yes, you are correct. What you are referring to is the 4th amendment which protects against unwarranted search and seizures. But to be honest I have something like that on my entire network with the hopes I will never use it.

 

[APTI]

Yup. It's fairly common. Given the number of times I've crossed international borders, I'm probably a rarity in that I've never been asked to unlock my phone. I did have one customs agent look heavily at the case my phone was in, probably because it was bulky.



Yup. As mentioned above, they've decided that they can force you to use your finger or face, or any other biometric data. At the same time, the courts have long upheld the right to keep private that which is in your head.

It might be worth doing a combination. Say, both a fingerprint and a PIN.

I'm liking the idea of a duress PIN. I just don't see any reason to put the effort in. It's not something I'm likely to ever use. Any situation where I would use it would likely be a situation where they introduced a rubber hose to the discussion.

I feel it is better to be like Barney Fife and have one bullet in your gun in case you need it rather than try to load it in the 2 seconds you need it. Better to have and not use than need and not have. Even Star Trek computers and ships have self destruct.

 

[KGIII]

you could do a simpler version that would be mush better type a pin code wrong 5 time or something and the phone wipe it self

I forget the name, but there's a mobile OS like that. I think the iPhone has some similar feature, but don't quote me on that. It might just uber lock it down and then require going online to bypass the restrictions? Something like that. My understanding is that the iPhone is pretty secure.

But to be honest I have something like that on my entire network with the hopes I will never use it.

It'd make sense for a laptop to have such features, especially if you have employees who are prone to losing stuff. Of course, there are a variey of business tools for this. Intel uses the vPro Platform now, but they've had other things like that in the past.

Most Linux users don't want those features. It will connect back to the mothership to see if it has been stolen or whatnot. It's built into the BIOS/UEFI, though it can be disabled. (Which is why a business should password protect the BIOS, of course.)

If you're a really pedantic business, you might even opt to disable the USB ports. You then whitelist the USB devices allowed to use the ports -- and absolutely disable automatically running anything from USB.

I feel it is better to be like Barney Fife and have one bullet in your gun in case you need it rather than try to load it in the 2 seconds you need it.

LOL I usually have a full magazine. I mean, I only (usually) carry a .22 LR sidearm. If there's anything major, I'm going to have to plink them more than once. If I'm carrying, it's usually open carry. The sight of it serves as a deterrent for the more stupid people among us.

I'm in Maine. Quite a while back, we led the way in making it 'constitutional carry', meaning any lawful person can carry a concealed firearm. I also have my CWP, so that there's reciprocity with other states. I don't need it in Maine, however.

To that end, I'm seldom armed. There's no crime in the area. If I'm armed, it usually means that I'm carrying a bunch of valuable stuff. Even then, it's usually just a .22 LR. I can fit a fistful of magazines into my pocket, and nobody will even know they're there. Besides, who doesn't love a Ruger?!?

Anyhow, contrary to beliefs, Maine did not turn into a violent place with an increase in 'gun violence'. That's what many people predicted when the law was passed to allow any lawful owner to conceal their weapons.

Also, as per your other post, the 4th doesn't really apply here. It hasn't for way too long. They do not need a warrant to search you, your phone, etc while going through customs. It does apply in that they don't have to give up what is in their heads. But in this case, the 5th is more appropriate. They don't have to help the government prosecute them, so they're not obligated to give them the correct PIN.

Anyhow, it's known as the 'border search exception', which has actually been a thing for like a hundred years -- but was modified a bit by the PATRIOT ACT, which also included expanding what they're calling the border.

It's going to be an interesting case.

There's also the case of Alain Philippon, in Canada, but they took a plea agreement rather than fight the case.

As for the US, this is a recent update to another case:

EFF to Third Circuit: Electronic Device Searches at the Border Require a Warrant

EFF, along with the national ACLU and the ACLU affiliates in Pennsylvania, Delaware, and New Jersey, filed an amicus brief in the U.S. Court of Appeals for the Third Circuit urging the court to require a warrant for border searches of electronic devices.

www.eff.org

 

[Trml]

It'd make sense for a laptop to have such features, especially if you have employees who are prone to losing stuff.

With respect to Linux, I'd like to contribute a reference to point "5.21 Why is there no "Nuke-Option"?! of the cryptsetup FAQ (you have to scroll, can't link it direct): https://github.com/mbroz/cryptsetup/blob/main/FAQ.md?plain=1#5-security-aspects

If you use convenience features, like unlocking LUKS encryption by TPM or a security key, that summary does not hold, of course. They can use the convenience, like a fingerprint. That aside, I can share from personal experience that businesses, including ones with US American owners but staff abroad coming to the USA on business, regularly have company policies to wipe critical data before travel to quite a long list of countries (incl. the USA). It is completely normal in the business world to keep your data "at home" and use secure means to access it from abroad. Immigration is one particular risk due to their powers, losing a device in the taxi from the airport the next.

 

[KGIII]

regularly have company policies to wipe critical data before travel to quite a long list of countries (incl. the USA)

Yup. Yet, time and time again, we still learn of stolen laptops with the keys to the kingdom on them.

With modern broadband, just keep the system clean and access the important data once you're in the country -- and clean it when you're done.

My business didn't do too much on the international level. We did a few projects here and there, but it was all muni stuff and nothing too private. One of the neatest projects was doing the modeling for a walking city (pedestrian sections of the city) for an EU company located to the north.

I also, while largely working on another project, got the chance to model one of the 'magic roundabouts' in the UK. Evidence shows that it's remarkably efficient after the locals understood how it worked. People from outside the area had more problems. So, yeah, it's pretty much what was expected -- but now there's data to back that up.

Linux users can likely still take advantage of the offerings from the likes of Intel, as mentioned above. That should be OS-independent.

 

[deb_user]

The only real defense I can come up with for this guy is that apparently he didn't do the destruction himself, the agents did when they entered the PIN. If he had made the entry himself, he might be sunk, but if the agents made the entry, then the destruction was the same as if they had physically broken the phone with a sledgehammer trying to get in. I am not a lawyer, and I didn't stay at a Holiday Inn Express last night, so I could be wrong, but that's what comes to mind.