Comment by grapheneos

GrapheneOS has built-in encrypted backup and restore. It backs up the same data transferred by Google's device transfer feature for moving to a new phone which is nearly all app data, the data in the home directory, contacts and a bit more. Certain apps such as Signal encrypt their own data with another layer of encryption using a hardware keystore key. Signal's own backup system needs to be used for that, although it can just be used as a way to get data into the system backup.

It's worth noting wiping a device shortly before an anticipated search could also be considered destruction of evidence in the same way. It doesn't have to be done after a request for the data to be considered that.

> There's no deception required to protect sensitive data or avoid the seizure of an expensive phone. Consent to unlocking the phone, refuse to unlock the drive. The drive gets seized and you go on your way (if you're a US citizen entering the USA).

This was likely the best move for him to take. They could have held him for a while and wasted his time but eventually would have had to give him access to a lawyer and let him go. Unless they had a recording of him entering a PIN/password, they were nearly certainly not going to get his data from it. He very likely didn't gain anything from wiping it.

He did help every GrapheneOS user by spreading awareness of the duress PIN/password. It was designed around an adversary aware of it and therefore not wanting to attempt using a PIN/password obtained via coercion. In the future, we want to integrate the feature into the secure element rate limiting for key derivation so it can't be avoided by exploiting the OS.