The DOJ Is Prosecuting a Duress Passcode the Same Week India Banned the App That Needed One
I don’t have much sympathy for prosecutors who treat a phone’s security feature as evidence of criminal intent. That instinct made this story easy to write off as one more overreach the moment I read the headline.
It’s not that simple, and pretending it is would waste the more interesting story sitting right next to it.
The DOJ is prosecuting a Cop City protester for allegedly giving CBP a duress passcode — the GrapheneOS feature that wipes a phone’s contents when entered under compulsion — treating the wipe itself as obstruction. In the same week, India ordered GitHub to remove Bitchat, Jack Dorsey’s offline messaging app, because anti-government protesters were using it during internet blackouts. Two governments, two different legal levers, and the same underlying target: software designed to keep functioning, or keep quiet, precisely when a state wants it to do neither.
What Is Actually Being Prosecuted?
Ask the question the DOJ’s theory depends on: is the crime the wipe, or is the crime having anticipated that a wipe might be needed? A duress passcode doesn’t destroy evidence a person otherwise would have preserved — it’s a feature that exists for exactly one purpose, activated at exactly one moment, under exactly one kind of pressure. Prosecuting its use as obstruction doesn’t punish an act of destruction so much as it punishes the foresight to install GrapheneOS in the first place. That’s a much broader chilling effect than the indictment admits to.
Bitchat’s Removal Skips the Argument Entirely
India didn’t bother with an obstruction theory. It went straight to the distribution layer and ordered GitHub to pull the app, which is a cleaner and more honest move in one sense — no pretense that Bitchat’s offline mesh networking is itself unlawful, just an acknowledgment that a tool built to work without the internet is a problem specifically because the internet is the thing getting shut off. Bitchat’s entire value proposition is a liability the moment a government decides connectivity is a lever it wants to pull.
The Distinction Worth Keeping
A duress passcode protects a specific individual under specific coercion. An offline mesh app coordinates a crowd during a blackout the state itself imposed. Those aren’t identical acts, and a legal system that can’t tell them apart is a legal system I’d trust with neither case.
But both prosecutions rest on the same premise: that designing for a moment when the state shouldn’t be trusted is itself the offense. I don’t think that premise survives contact with either court.