GrapheneOS and Aiports (And other forced unlock scenarios)

[deleted] true but if not you could buy a new Pixel 6a (if available in the country), put GOS on there and restore the backup. Or yeah just find another solution like buy a cheap phone and use it only for necessary stuff and without logging into accounts. In the end it's all about preparing properly according to your threat model.

I lived in Australia for many years and traveled frequently. The border control issues started taking off around 2017 and got progressively worse.

tezeron Best advice is the travel phone, theres no way around it. If picture quality is a concern then a dedicated camera would be what you really want but that may be expensive and depending where you're visiting may even make you a target for thieves. I suggest getting a used, eol pixel since it will be cheap enough to not worry about (in case you never see it again) but just add the bare minimum of info/apps needed, for example offline maps, temp communication apps like simplex, prepaid sim from the country you're visiting, etc... If you're really paranoid you can keep it on airplane mode or just turn off the device when you dont need it. This is the only use case imo for using an end of life device since you get a pretty decent camera and a temp device for a low price. When you get home, backup the pictures and other data you would like off the travel phone, factory reset it if you like, and keep it somewhere safe until your next trip.

I travel with my phone anywhere just fine without any issues, best way to ensure you're all good is to just backup whatever you need on your phone encrypted to your own cloud server or storage box and factory reset your GrapheneOS phone and then flash it back to Google Pixel stock before going to the airport and then after you're already in the country you flash it to GrapheneOS and recover your data and enjoy your trip.

Flashing back to Google is my recommendation because if someone who knows phones might know about GrapheneOS and find it suspicious, so just go ahead and eliminate that worry by flashing it back to Google Pixel software and then use GrapheneOS once you already passed through fine.

This is the best way and it doesn't really take much time to do it if you're really worried about staying safe.

GrapheneLover I disagree. Border Control still has the power to take your phone, and they will do, given enough suspicion.

[deleted] What is there to disagree about? What I wrote above your phone is very unlikely to get confiscated if you follow the directions I stated. That's why you would flash it to Google stock first so there is no suspicions. I'm willing to hear why you disagree though.

[deleted] What is there to disagree about? What I wrote above your phone is very unlikely to get confiscated if you follow the directions I stated. That's why you would flash it to Google stock first so there is no suspicions. I'm willing to hear why you disagree though.

[deleted] Yes you're right it depends on your physical behavior and also can be your looks and as well as you can have red flags on your profile. I have seen Australia first hand and have been to dozens of countries throughout Asia, Africa, and Europe where there are tight security measures. I have had zero issues regarding the phone situation as I have followed my methods, as long as you comply with them and give the password to your "fresh" phone and let them do whatever they want with it they have always returned it to me, and then I flash it back to whatever ROM there was back in the day or to GrapheneOS nowadays.

Let's not discuss about what border control personnel would or would not do. The OP suggests you get pulled and asked to hand over your phone and access to it. How do you protect your data in case this happens?

tezeron
In the end it all comes down to not having any data that you want to protect with you while crossing the border. It's the only way to be sure it can't be confiscated, copied or cracked down the road. Whether you solve this through burner phones, wiped phones, online backups, no phone at all etc. is for you to decide. Maybe your threat model allows for most of the data to be confiscated, which would add convenience. Maybe your threat model is to not give any data while perfectly blending in, in which case you would probably invent a whole new identity on your border phone.

I think I would just carry a dumb flip phone, but I have the luxury of sitting around and playing in my head, without much need to face reality.

Whatever deficiencies some may see in GrapheneOS, because it lacks some pet “feature”, it seems to be the best we have today to protect those who truly need it.

Good luck to each and every one of the folks who face such circumstances.

Travel with 2 devices

• one dumb phone with almost fake contacts (do not reuse an used dumb phone because deleted data can be recovered with physical extraction and it's not easy to properly overwrite data on them) you don't want to be associated with a drug dealer if the phone is from second hand market.

• one empty google pixel with stock OS (GrapheneOS will rise suspicion)

All important data will be in the cloud. Do not trust cloud providers zero knowledge encryption and encrypt your data locally before to upload.

Password to encrypt your data on your computer or phone must be different from the one you will use to access that data in the cloud.

Once safe at home, install GrapheneOS and set your pixel again. Not convenient but it's the best thing to do.

Don't send your phone with data through post, it's risky. Package can be lost, stolen or confiscated.

tldr

these questions are so often I dont get it, don't people know about cloud storages?
whats holdingb them from backing up the data, wipe the phone and cross the border and if you wish so agree to the requirement of the LE and give them a brand new empty phone?

is this so difficult in 2025 to use a cloud storage???

https://www.ctvnews.ca/vancouver/article/can-us-border-guards-deny-entry-based-on-cellphone-contents/
This measure was taken by the U.S. authorities because the researcher’s phone contained exchanges with colleagues and friends in which he expressed his political opinion on the policies of the Trump administration on research,” French Higher Education Minister Philippe Baptiste told AFP shortly after the incident involving the French scientist.

I still think the best solution is to use a burner phone, with not much info but enough stuff to make it appear convincing. . Leave your real phone turned off in a safe location back home. You can have a lot of back up data on a tiny sd card that will likely go undetected in your pocket, or once you are in said country with your burner phone, you can download the necessary data from encrypted cloud. Be fully cooperative with border guards.

The tough part is that wiping and restoring the device is rather impractical. Sure, if you have basically no apps, that's fine.

But some of us visit, live and work in several countries, and need access to certain services. For example, I have bank apps that can't be re-activated on the phone unless I'm standing in front of the ATM to scan a rotating QR code. If I leave the country and wipe my phone, I'm without banking access until the next time I'm there. That either sucks or is totally not possible (bills to pay, etc.). Some places have government services apps that are geo-restricted (ok, those are easy to fool, but still takes time and maybe 2 phones so you can set up a hotspot with vpn+proxy). Even things like metro cards that contain your app private key would be a hassle to restore. And then 50 apps that you just have to set up again for the umpteenth time because the developers are too young to provide an Export Settings feature.

The real issue preventing all of this is a true disk image backup, because if you had that, everything, including private keys and file date/time stamps would be preserved. Without it, relying on Seed or others makes it a no-go.

Another option is to use virtual machines, snapshot it before the border, encrypt and offload to USB, and then reverse the process. But GOS would need to support VMs other than just Linux command line stuff. Would be great if instead of user accounts we had full GOS VMs.

The one suggestion from elsewhere that I could get behind is the concept of entering a duress code that silently deletes a specified user account and logs in as Owner. You could keep your phone intact, and only if it looks like you're going to be pulled aside, enter that code, and eventually hand them the phone. The owner profile, of course, only contains the stuff you're wiling to have snorted into the government database, provided they can crack the encryption.

I'm torn between just hoping they can't read a GOS phone, and deleting a handful of apps that might appear "interesting" to ignorant people in some other countries -- including the US now.