Comment by Zak
4 hours ago
For exactly the border search scenario, I wish smartphones could be imaged and restored as easily as PCs. Imagine booting the phone from a flash drive, making an encrypted image of the phone on said drive, and writing a fresh OS before reaching the border.
There's no deception required to protect sensitive data or avoid the seizure of an expensive phone. Consent to unlocking the phone, refuse to unlock the drive. The drive gets seized and you go on your way (if you're a US citizen entering the USA).
Some time ago, Android with a custom recovery could come close to that, but it was fussy and as far as I know, no longer viable. Increased use of TPMs for storing credentials seems to be at least one of the reasons.
It may be fun to fantasize about these things some times, but there is no technical solution to tyranny. Laws are not like code, intent matters. Ultimately if the intent is that the government wants to see your private data, hiding it in any way will be charged - it doesn't matter if you jump through hoops to avoid this specific instance.
This is a half-truth. In a full banana republic, technical compliance with the law will not prevent consequences for failing to do what the authorities want. In a jurisdiction with perfect rule of law, it always will. The USA is somewhere in between.
One of the laws that's enforced pretty well in the USA is the protection against unreasonable search. Most of the time, a search requires showing a judge evidence that the search is more likely than not to reveal evidence of a crime. Exceptions are narrow and specific; the government's options to punish someone who refuses to decrypt data at the border are limited to brief detention and seizure of the medium.
Not yet tested is the idea that erasing data on the spot satisfies the purpose of the border search exception, which is to prevent importation of things that are illegal to import. This case might address that question.
Unreasonable search is always under attack though. There are many instances today of cops forcibly entering a home claiming nothing more than a welfare check, or "we received a call."
Edit to add that its also more difficult than it should be to protect and exercise the right against unreasonable search. If a cop knocks on your door its a consent-based interaction. You can simply not respond, but if you do happen to crack the door they can and will look in for any signs to claim as probable cause. Further there are cases where a person stepped out to talk and when they turned around and walked inside the cop slid right in behind them and later claimed in court the open door was implied consent. (I don't have a link to the court docs unfortunately.)
9 replies →
we're far closer to one side of that spectrum than the other. consider the retroactively legalized mass wiretapping, room 641A, NIST compromises, PRISM, 14 Eyes, the other Snowden revelations, etc
then consider this paired with the implementation of mass data sharing between the alphabet agencies, surveillance data sharing from private companies like Amazon Ring, Flock, Clearview, etc. and NSPM-7 ordering agencies to create JTTFs to target organizations like BLM
then consider the unmitigated use of force by federal law enforcement agencies like ICE
I think if this were 1995 your point might be fair but those days are unfortunately long gone
Border search exception lowers the requirements for judicial oversight.
"In United States criminal law, the border search exception is a doctrine that allows searches and seizures at international borders and their functional equivalent without a warrant or probable cause. Generally speaking, searches within 100 miles (160 km) of the border are more permissible without a warrant than those conducted elsewhere in the United States."
https://en.wikipedia.org/wiki/Border_search_exception
213 milion people live in this zone.
https://www.aclu.org/know-your-rights/border-zone
I think I mostly disagree with this. "Technical compliance" is not and should not be the thing that a legal system is designed to incentivize, and should not be the criterion for "perfect rule of law."
Agree with the thrust of your comment, but I had to comment on this:
> In a full banana republic, technical compliance with the law will not prevent consequences for failing to do what the authorities want. In a jurisdiction with perfect rule of law, it always will.
I think you may be misunderstanding that many laws, even in fair, just societies, are intentionally designed to be flexible. The real world is so variable and messy that in many cases it isn't feasible for a law to be written such it can be unambiguously determined whether or not a specific action violated the law. Laws often rely on humans using context to judge whether something violates the spirit of a law, and in a just society, this is a good thing.
My point is that I don't believe the idea of "perfect rule of law" is sensible. Law is always necessarily a bit fuzzy and nebulous.
1 reply →
Having good technical tools won't fix a failing society, but they're still nice to have and they make state surveillance of its citizens just a little bit harder. I mean, where would we be without strong cryptography?
Normally I agree, but making the implementation initially ineffective is a good way to complicate more far reaching measures.
Americans aren't standing up against this, but they might have considerably more interest if the government was instead trying to ban encrypting data in cloud storage for everyone.
There's also just the fact it's ridiculous I can't have a spare phone ready to go in a few minutes and get it back exactly as I left it.
Yes, trying to solve a regulation or legal issue by some technical workaround will never work, you have to fight it at the same level, legally, or system-wise, otherwise, you will be like the person who tries to wash the stairs from the bottom all the way up, it rarely works, you gotta go up to down, collectively go against the matter rather than individually duct taping it for your own specific needs. In that example, it won’t be far fetched the same ones who made it illegal to wipe your phone to make illegal to install xyz OS or using abc protocol, in fact, that’s exactly what they are trying to do under the disguise of “protect the kids” and going after encryption or similar privacy related issues.
They would not be so vehemently against it if it did not work. There is a reason E2EE, duress passwords and similar technologies are under such intense assault these days.
Those "nandroid" backups weren't "close" to that, they were literally that initially. Then, when Android phones started coming with the /sdcard partition mapped to the internal flash memory (a subdirectory of /data) instead of an actual SD card, the /data partition backup mechanism was changed to copy individual files into some sort of archive, but the end result remained the same.
You can still do it on modern Android devices, as long as the bootloader is unlocked. Yes, the file system is encrypted, but a modern custom recovery is able decrypt and mount it.
How many mainstream phones come with unlocked bootloaders? Just pixel right?
GrapheneOS has built-in encrypted backup and restore. It backs up the same data transferred by Google's device transfer feature for moving to a new phone which is nearly all app data, the data in the home directory, contacts and a bit more. Certain apps such as Signal encrypt their own data with another layer of encryption using a hardware keystore key. Signal's own backup system needs to be used for that, although it can just be used as a way to get data into the system backup.
It's worth noting wiping a device shortly before an anticipated search could also be considered destruction of evidence in the same way. It doesn't have to be done after a request for the data to be considered that.
> There's no deception required to protect sensitive data or avoid the seizure of an expensive phone. Consent to unlocking the phone, refuse to unlock the drive. The drive gets seized and you go on your way (if you're a US citizen entering the USA).
This was likely the best move for him to take. They could have held him for a while and wasted his time but eventually would have had to give him access to a lawyer and let him go. Unless they had a recording of him entering a PIN/password, they were nearly certainly not going to get his data from it. He very likely didn't gain anything from wiping it.
He did help every GrapheneOS user by spreading awareness of the duress PIN/password. It was designed around an adversary aware of it and therefore not wanting to attempt using a PIN/password obtained via coercion. In the future, we want to integrate the feature into the secure element rate limiting for key derivation so it can't be avoided by exploiting the OS.
PinePhone will boot off a microSD before the internal flash, so you could have a clean OS on the card and your real one on the flash. The SD card is under the back cover with the battery and SIM, so chances are they won't think to try to remove it.
> I wish smartphones could be imaged and restored as easily as PCs. Imagine booting the phone from a flash drive, making an encrypted image of the phone on said drive, and writing a fresh OS before reaching the border.
Backing up and restoring an iPhone is extremely easy. You don't need to imagine all of this flash drive or encrypted imaging stuff. You plug it into your computer and do a backup. You can then wipe the phone through the menus. Restoring from the same computer is easy.
Except apps themselves don't get backed up, only their data. So if you had any apps that are no longer in the app store or that came from outside of it (e.g. TestFlight or development builds), those won't be restored.
I've restored iPhones before, and it does seem pretty simple. Easier than PCs for sure. It's not instant, but the basic configuration is restored pretty quickly while the bulk data restoration happens in the background while you're able to use the phone.
What about banking apps and stuff? Does the device binding still work or do you need to set it up again?
Depends on the app and security setup. If it's using old school Symantec VIP Access, it will not survive a restore. If it is using TOTP from 1Password, it will. Not sure about other options, those are the two I am most familiar with. Thankfully I only have a single app these days relying on VIP Access.
Also, it is just a nice idea if you are prone to losing phones. Backups are good for all kinds of reasons.
> For exactly the border search scenario, I wish smartphones could be imaged and restored as easily as PCs.
You're always been able to backup and restore your iPhone to your local Windows PC or a Mac using free first party software from Apple.
There's a way simpler solution and it's just to leave your phone at home and put your SIM in a different handset without all your data on it
An increasing portion of phones are eSIM [0] only these days, and the difficulty of swapping can be weirdly-bad depending on provider.
[0] https://en.wikipedia.org/wiki/ESIM
But non esims exist still, and if you're that worried about security, you can get one.
1 reply →
How about every civilian banding together and refusing to comply?
in before those fucking "I hAvE nOtHiNg tO hIdE" twats
> ...making an encrypted image of the phone on said drive... refuse to unlock the drive
How is this any different than refusing to unlock the phone? It just seems you've added unnecessary extra steps.
As I understand it, the drive can thus be seized, and a potential loss of a cheap flash drive is a lower inconvenience than loss of the phone.
Think for a moment. What is the difference between giving them a password which wipes the phone and giving them a password which opens a blank phone?
It's the same thing. They punched in a code, they are presented with a wiped phone. Can they prove the guy gave them a distress password and wasn't simply carrying a wiped phone to begin with? No, but they just need to imply that is the reason to charge him with the felony.
> What is the difference between giving them a password which wipes the phone and giving them a password which opens a blank phone?
> It's the same thing. They punched in a code, they are presented with a wiped phone.
No, the behavior between the two is in fact visibly and obviously different.
The regular passcode unlocks the phone. The duress passcode reboots the phone and resets it. I know this because this is literally what previous articles said happened when they entered the passcode in regards to this case.
See for yourself:
https://www.youtube.com/watch?v=jcgnBjHOK2g
Tyranny does not care about "proof".
It doesn't even care about plausible deniability.
Best you can get away with is lack of suspicion. Have a secondary phone with some standard apps on that you use now and then so theyhave a history and just look like you are just not a technical person and read novels on dead trees instead. A lot of work but likely works.
are we seriously approaching a point where its quasi-illegal to not participate in the socials?
1 reply →
The best technical solution is one code opens to a phone that has things but isn't your actual phone, and then another code that opens to your real phone.
Have you considered "no password set"?
>What is the difference between giving them a password which wipes the phone and giving them a password which opens a blank phone?
They don't get any indication that there was data there to be deleted, and you don't just factory reset but flash w an image of a clean phone that's been used. It has apps, it has accounts, it looks to the untrained eye (because that's who's looking at it) like a phone that was used normally by someone who has done nothing wrong.
> refuse to unlock the drive. The drive gets seized and you go on your way (if you're a US citizen entering the USA)
… yeah I doubt that nowadays honestly
Really? Does it take a long time to recover the phone? Haven’t really ever needed to recover a backup
Apple makes this very easy. I broke an iPhone and bought a replacement. If you have iCloud, you login to the new phone and you can see which backups you can recover from. If you are transferring a phone, say you upgraded, it’s even easier. You can also image the phone with a connected laptop and store it on a backup drive, which is nice to not use up iCloud limits.
The transfer and backup system are pretty much the same mechanisms.
Restoring is probably order of ~1 hour to go through all the setup. Then some hours to sync any data and updates that need to be redownloaded, apps reinstalled, etc.
Aha that is actually pretty long
1 reply →
I mean, you could ship your real phone to w/e destination ahead of you and bring a $50 burner to the border. If you're a person of interest this won't work because they can monitor you and the destination but if you're a regular schmuck then a burner that never touches your private data or accounts and has a bunch of dummy stuff on it will get you past the border goons.