My Response to the GrapheneOS Duress Password Arrest

A number of people have wondered what I have to say about the recent news coverage of the activist who used his duress password on GrapheneOS at customs and is now in legal trouble. In one way, I don't have anything "new" to say about it, and in another way I have an enormous amount to say on this topic. But mostly I feel simple in myself about it. Meaning, nothing from my position changes from this event.

One thing I've always noticed when people ask me about things like this is that it often comes in the form of a challenge. I just want to be clear: my position on privacy and security is not one of trying to prove myself or the established truths of this industry. I don't need to prove them—they've been proven, and I have enough understanding to know that saying otherwise doesn't make any sense.

Even when I say something like our right to privacy is diminishing, and any future generation's right to privacy is at risk because of that—and the actions we take now impact the future—that's not me trying to convince anyone. I know that is happening.

However, I do feel a responsibility to say something because I do recommend GrapheneOS to people, and I still will. So, here's my take on this:

This isn't about GrapheneOS or the duress password getting you arrested. This is about what is happening to activists in our current political moment—while also recognizing it's been happening for decades.

The absolute first thing I would like to reiterate is what say in my “About” section, because this is precisely why I say something to this effect: “there is no one magic button that makes anyone secure, safe or private on the internet.” Likewise, there is no one pass code that can magically change everything we might be facing at border crossings right now. Nothing like that truly exists and every security tool needs planning and strategy in order to be safe and effective. And even then that is not 100% safe or effective. This is why I speak of awareness and the risk of those unaware using tools they don’t fully understand.

Before using a duress password or having one, you must understand that you cannot hand a border crossing agent an entirely wiped phone and expect them to believe that something isn’t up. That is not smart or realistic on any level.