Thread

Cops Can Bypass iPhone's Automatic Reboot to Get into Locked Phones

287 points · 226 comments · speckx

delichon · 1790868019 · focus · HN ↗
I keep all of my most sensitive personal documents on my phone, as an emergency backup, but in an encrypted (Cryptomator) volume that requires a separate password. Given the routine news of such exploits this seems like due diligence.
As I understand it this encryption is a significant additional barrier to technical or legal access to those files. If someone knows otherwise, please let me know. Being wrong could cost me my home and life savings.
1. WithinReason · 1790868570 · focus · HN ↗
  If you don't give access to law enforcement when they ask: straight to jail. Encryption is irrelevant in that situation. If they see the encrypted volume you need to provide them access.
  1. ChrisMarshallNY · 1790868979 · focus · HN ↗
    Classic $5 wrench.
    Having thugs on speed dial opens a lot of doors.
  2. rdevsrex · 1790869100 · focus · HN ↗
    Maybe in a country like the UK, but not in the US. The Fifth Amendment protects against self-incrimination.
    Which covers divulging encryption keys because it is treated the same as compelling you to give up the combination to a wall safe which is testimonial and protected.
    DaveSchmindel · 1790869915 · focus · HN ↗
    That's been my understanding until now as well... the latest on the case against Samuel Tunick has me worried and second guessing that blanket statement though...
    <a href="https://nccriminallaw.sog.unc.edu/2026/08/03/giving-police-a-duress-code-instead-of-a-passcode-to-a-phone/" rel="nofollow">https://nccriminallaw.sog.unc.edu/2026/08/03/giving-police-a...
    delichon · 1790870313 · focus · HN ↗
    Yeah, if you use it as a way to destroy data that gives them a whole new and powerful attack vector. 18 U.S.C. § 2232 is very broad.
    Razengan · 1790877870 · focus · HN ↗
    What's more infuriating than laws like that is that there's a class of people completely immune to those laws.
    simiones · 1790872256 · focus · HN ↗
    That's completely different. Pleading the 5th and not testifying is completely different from giving false testimony - which is never protected. Even in a trial, if you are asked under oath if you handled the body, you are allowed to say that you invoke your 5th amendment rights not to respond; but you are not allowed to say "no, I didn't" if in fact you did (you can later be accused of perjury in addition to your conviction).
    rtkwe · 1790875578 · focus · HN ↗
    That case has the specific, very important, wrinkle that he provided a _destructive_ duress code, he could have continued to refuse to provide the unlock code just fine legally. It's the use of the duress code that is likely going to be getting him in trouble and that falls outside of the existing defined protections about being compelled to unlock safes/computers etc containing possible evidence against yourself.
    We'll have to see how that case goes but ultimately the reason he's getting in trouble is only tangentially related to his phone being encrypted. It's more correct to think of it like he smashed the phone to pieces (and imagine this definitively destroys the data for the sake of the metaphor) instead of it being about the encryption itself.
    LoganDark · 1790885186 · focus · HN ↗
    He didn't smash the phone to pieces, he gave LE a hammer and they smashed the phone to pieces. It's entirely LE's own fault this happened -- they shouldn't have been trying to get into that phone, and it's their own fault it went wrong.
    Though I would expect courts to consider that he knew LE planned to enter the provided PIN, and that the duress PIN would then result in the phone being wiped, and therefore accuse him of doing the wiping anyway.
    But I don't think it's this guy's fault at all. LE is the one who asked him under duress, he easily could've feared for his life, and he did no direct harm. It was self-defense at worst.
    someothherguyy · 1790886879 · focus · HN ↗
    > He didn't smash the phone to pieces, he gave LE a hammer and they smashed the phone to pieces. It's entirely LE's own fault this happened -- they shouldn't have been trying to get into that phone, and it's their own fault it went wrong.
    Setting a booby trap to destroy evidence that then gets destroyed when that trap is triggered is the same as destroying evidence. This is common sense, but also see <a href="https://en.wikipedia.org/wiki/Principal_(criminal_law)" rel="nofollow">https://en.wikipedia.org/wiki/Principal_(criminal_law)
    rtkwe · 1790893268 · focus · HN ↗
    That's too cute by half for the law, this kind of "I'm not touching you" argument comes up each time and it just doesn't work. The guy intentionally provided the code knowing it would destroy the "evidence"/contents of his phone if they entered it, it's clear what his intent was and the data would not have been destroyed if he did not take that action. The minor separation that he did not enter the code himself is highly unlikely to protect him in this case.
    It's been a weakness in destructive duress codes since their inception.
    [deleted] · 1790877846 · focus · HN ↗
    [deleted]
    glitchc · 1790870558 · focus · HN ↗
    > The Fifth Amendment protects against self-incrimination.
    You can still be held in custody for obstruction of justice:
    <a href="https://www.findlaw.com/legalblogs/third-circuit/man-held-in-contempt-for-refusing-to-unlock-devices-in-child-porn-case/" rel="nofollow">https://www.findlaw.com/legalblogs/third-circuit/man-held-in...
    It took four years before he could secure his release:
    <a href="https://www.sophos.com/en-us/blog/suspect-who-refused-to-decrypt-hard-drives-released-after-four-years" rel="nofollow">https://www.sophos.com/en-us/blog/suspect-who-refused-to-dec...
    izacus · 1790870969 · focus · HN ↗
    Self-incrimination yes, but not for cases when the person compelled has evidence to incriminate another process in a case.
    roncesvalles · 1790883328 · focus · HN ↗
    That being said, overlap protects you still. So if answering a question about another person might incriminate you, you don't have to answer.
    rdtsc · 1790874816 · focus · HN ↗
    Can't they just hand it to you say "you enter your passphrase, but don't divulge it to us and then hand us the phone". In other words hinging the passphrase divulging to the 5th can backfire in that respect. It like saying we have a search warrant, you open the safe for us, it's fine if you keep the combination to yourself, we just need to get inside.
    nater5000 · 1790877275 · focus · HN ↗
    No, that's pretty absurd. It's not specifically about the act of speaking. It's the act of incriminating yourself.
    But that's all beyond the point, anyways. If they did hand you your phone and said, "enter your passphrase," you can just say, "I don't remember it." They can throw a fit and put more heat on you in various ways, but until they resort to torturing you or they develop mind-reading technology, there's not much they can do at that point until the case reaches a judge.
    That's not to say "I don't remember" is a sound, blanket defense. But it's sufficient for demonstrating that these dynamics all depend on willing participants which is partially why these laws are designed the way they are.
    rdtsc · 1790881960 · focus · HN ↗
    If the search warrant and seizure wasn't a thing I'd agree with you. But I can easily see opening a phone interpreted not that differently than opening a safe or your reinforced front door.
    > But it's sufficient for demonstrating that these dynamics all depend on willing participants which is partially why these laws are designed the way they are.
    What happens if during serving a search warrant the door is impossible to open or they find a super reinforced safe. Owner can even say "I don't remember the combination"?
    sterlind · 1791071324 · focus · HN ↗
    I'm not sure the police can compel you to open a safe. they can get a warrant to have someone weld it open with a blowtorch, but I don't think they can get a warrant to compel you to open your own safe for them.
    kadoban · 1790882982 · focus · HN ↗
    The act of unlocking it can incriminate you. It's ~proof that you have control of the device beyond what they already knew.
    midas89 · 1790876708 · focus · HN ↗
    you have the guy sitting in jail waiting for the courts to decide if his grapheneOS wiping his computer after wrong unlock codes is him obstructing.
    keep in mind that the "obstruction" charge can be and is abused as a catchall charge.
    MC995 · 1790877278 · focus · HN ↗
    > courts to decide if his grapheneOS wiping his computer after wrong unlock codes is him obstructing
    He didn't provide an incorrect code, or no code at all, he provided a duress code intended to destroy the device. There's a huge legal difference.
    nikanj · 1790878503 · focus · HN ↗
    The fifth amendment doesn't do jack shit if they haul you away. After a few years of trials and appeals you might regain your freedom.
    wslh · 1790880727 · focus · HN ↗
    I think that the issue is that the law enforcement personnel could make you pass a bad time even if it's covered by the Fifth Amendment. The enforcement could be later than the arbitrary decision.
    BeetleB · 1790885207 · focus · HN ↗
    He said "jail", not "prison".
    There's a difference.
    throw0101c · 1790886734 · focus · HN ↗
    > Maybe in a country like the UK, but not in the US. The Fifth Amendment protects against self-incrimination.
    SCOTUS: Hold my beer…
    :)
  3. gonzalohm · 1790869668 · focus · HN ↗
    So if an app installs an encrypted volume for which you don't have the password to, you go to jail? That doesn't make sense. How can they know if I have the password or not
    wahern · 1790870479 · focus · HN ↗
    They can't know, they infer. AFAIU, normally they just detain you at the airport and harass you to try to break you. To jail you they're technically supposed to be confident enough about you knowing the password to be able to charge you with a crime (presumably something like obstruction, possibly specific to immigration law, otherwise right against self-incrimination might prevent a conviction on failure to disclose alone), or have other evidence of some other crime. Then you end up in the legal system, where courts handle due process and a judge, preliminarily, and then a judge or jury decides if you knew the password.
    Note that the recent high-profile case of a man being jailed involved him refusing to decrypt, rather than claiming he didn't know. He was deliberately trying to test the law regarding the permissible scope of inspection of digital data, to force the matter into the courts so the issues could be litigated in a controlled context untainted by other potential crimes; being arrested and charged was part of his plan.
  4. spl757 · 1790882372 · focus · HN ↗
    Precisely, unless there is plausible deniability that a blob of data is indeed an encrypted file they can just hold you in jail until you comply. There are encryption schemes that provide plausible deniability, but implementing would probably not be trivial.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.