PSA: Law Enforcement Can Trick You Into Giving Them Access to Your Phone

I’ve written before on the contentious relationship between privacy advocates and law enforcement agencies, who are all the time encroaching further upon your personal privacy. Be sure to check out this article on defending yourself with a strong passcode.

Recently it was reported by NBC News that Grayshift, the company responsible for developing the atrocity that is the GrayKey device (used to unlock citizens’ iPhones via brute force passcode attempts [learn how to protect your device here]), has developed software they call HideUI, which is malware designed to trick people into unlocking their devices for police officers.

In order for this feature to work, law enforcement officials must install the covert software and then set up a scenario to put a seized device back into the hands of the suspect, said the people familiar with the system. […] For example, a law enforcement official could tell the suspect they can call their lawyer or take some phone numbers off the device. Once the suspect has done this, even if they lock their phone again, Hide UI will have stored the passcode in a text file that can be extracted the next time the phone is plugged into the GrayKey device. Law enforcement can then use the passcode to unlock the phone and extract all the data stored on it.

If law enforcement takes your phone out of your sight for even a second, assume they’ve installed HideUI on it. Consider it a complete loss, and buy a new one. If they give it back to you for any reason, refuse to unlock it. Throw it in a lake. Do not trust them or the device.

Furthermore, many courts have determined that while they can compel people to provide biometric data like fingerprints or their face to unlock a device (in line with precedents that allow them to compel you to provide DNA or hand writing samples), they generally cannot force you to provide an alphanumeric passcode to unlock the device because it is considered self-incrimination and a violation of your fifth amendment rights. You may be wondering why it even matters if they can still force you to unlock your device with your fingerprint or face. But, there’s one little tip you can use to ensure that your device can ONLY be unlocked by your passcode. If you turn your phone off before allowing law enforcement to take it, it will require a passcode when it’s turned back on. You can also disable biometric authentication in just two seconds by holding your phone’s volume button and power button at the same time.

This is why HideUI is dangerous: in many cases, law enforcement knows that they’d be unable to access your device lawfully, so they resort to shady tactics to trick you into giving them the master key, your passcode.

I strongly doubt any of my readers are criminals nor likely to be arrested for any reason, but as the government continues its encroachment upon our liberties, it’s important to remember our rights, and use the tools available to us to protect them from infringement. Use a strong passcode. Make sure your device is locked with biometric authentication disabled (via the side button/volume button trick) before allowing law enforcement physical access to your device. And don’t trust your phone if they take it out of your sight.