Potential appearances of GrapheneOS in mobile forensic reports

Couple thoughts from what is mentioned (have not read the document as I don't feel like downloading something that translates PDFs). Would love it if they got the Pixel in BFU and could not crack it. We don't really have any actual criminal trial reports on what LE can extract (if anything) from GOS with Cellebrite/GrayKey. Criminal/legal cases are the best as facts are under oath and adversarial - prosecution and defense providing their analysis - and public record. The fact that I have not been able to find a criminal case on GOS being cracked actual bodes well IMO.

We have alternative posts on the opened/unlocked phone being grabbed from her. This is how the FBI got Dred Pirate Roberts of Silk Road when he was using Tor and an onion website for his internationatioal dark web drug sales operation. FBI got a warrant to seize devices (a whole story in itself in how that came about) and set-up a sting team. Tailed him for a while and he went to a library to use its WiFi. FBI set-up a fake lovers quarrel near DPR that distracted him so they could grab his open laptop before he could close it where it would be encrypted. Thus, if you are doing some illegal stuff, undercover cops could always grab your open phone. They may figure criminals are aware of BFU and it is strong security with a stock iPhone or Android latest model/software in regards to Cellebrite/GrayKey.

quepasabebe

page 214. (if no other OS uses the same icons ofc)

I haven't checked the report, but based on the context, I assume there is a screenshot showing black & white icons, akin to those of our default apps.

This does not mean the devices are running GrapheneOS. We are aware of many GrapheneOS forks, including sketchy ones adding security theater etc.

Assuming something like this is GrapheneOS just based on the icon would be the wrong assumption to make if it's solely based on that, especially since we know these other forks doing sketchy stuff exists, because something that's compromised on these OSes may not be the case on GrapheneOS.

By that I mean, maybe these forks are adding features in an incorrect insecure way, or are otherwise removing things we've added, including low-level hardening, modifying our work in a misguided way, etc.

It doesn't have the mean that they're actively maliciously making the fork insecure. It could also be due to incompetence / lack of care.

Hope that makes sense.

matchboxbananasynergy maybe not a GrapheneOS phone, and I dont think it was portrayed as such - but it's still an interesting subject and part of the reason a lot of people chose GrapheneOS in the first place. I for one would like to see such subject matter posted here with full disclaimers.

wuseman

Suspect, [co-suspect] and [name 12] (hereinafter: [name 12]) use several telephones at the same time, including Google Pixels. Six Google Pixels were identified in the study. The Google Pixels run on the GrapheneOS operating system, which improves user privacy and security. In addition, the Molly application is installed on these telephones. Molly is a modified version of Signal, which is more secure.

The public prosecutor has taken the position that the suspect's mobile phone of the Google Pixel brand, type 4a, should be confiscated. The public prosecutor has put forward that the phone is a PGP device that is generally not returned to suspects and that the contents have not yet been examined because the device could not be decrypted.

The suspect has taken the position that the Google Pixel is not a PGP phone and that there are no incriminating matters on it. It is not clear to the suspect why this telephone still needs to be investigated, while the investigation has been completed

The court is of the opinion that the interests of criminal proceedings preclude the return of the Google Pixel mobile phone listed on the seizure list. This criminal law interest does not end with the conclusion of the investigation in the first instance. Now that the criminal law interest still opposes return, the telephone will be forfeited.

Source: https://uitspraken.rechtspraak.nl/details?id=ECLI:NL:RBOVE:2024:2048

Another:

The police saw on camera images that on the evening in question one of the suspects from the group placed or hid something in the parking lot near a fence. Later, officers found a Google Pixel phone and a Nokia phone near the fence. The Nokia was still on, because the screen lit up when the police found this phone. The court therefore assumes that the telephones belonged to one or more suspects.

The Google Pixel phone had the GrapheneOS operating system installed. This is an alternative operating system that is designed to guarantee privacy/anonymity as best as possible and to communicate anonymously. According to reporting officers, such telephones are frequently used in criminal circles.

Source: https://uitspraken.rechtspraak.nl/details?id=ECLI:NL:RBZWB:2023:6754

Basically whenever you come across court cases in the Netherlands where criminals used Pixel phones, it's 90% chance they had GrapheneOS installed on them since it's the most popular OS in Dutch criminal world. In a lot of court cases they straightly mention the google pixel phones as cryptophones and are able to confiscate them in a case against a s suspect solely because the suspect used a google pixel phone. Since this has become an issue some criminals are now using google pixel phones but modified the appearance of the phone to look like an Iphone since its less suspected during car checks and what not.