Duress credentials and coercive extraction
A duress credential is a safety control for a moment when another person forces the device owner to unlock a device. GrapheneOS currently offers a duress PIN or password that irreversibly wipes the device and installed electronic SIMs when entered at a device-credential prompt.
The feature is technically neutral about the coercer’s identity. The threat could be a robber, an abusive partner, a kidnapper, an occupying force, or a state investigator. The ethical analysis cannot assume that official custody makes the coercion benign.
Why the state context matters
Färre i häkte och minskad isolering records that Swedish detainees under full restrictions may spend 22 to 24 hours a day alone, and that international anti-torture bodies have repeatedly criticized Swedish remand isolation. The inquiry itself said Sweden used restrictions more than justified and needed a fundamental cultural change. JO inspections of remand isolation found in 2026 that a majority of detainees at four inspected facilities were isolated.
Harriette Broman remand isolation gives the cost a human scale: 556 days alone for 23 hours a day, followed by full acquittal. In that environment, “voluntary” cooperation with an interrogation or device demand cannot be evaluated as if the person were making an ordinary choice.
Overcrowding intensifies the coercive environment. JO inspections of remand detainees in police arrest found remand detainees held for up to 23 hours a day in police cells because the prison service had no place for them. Double occupancy in Swedish remand prisons found single cells routinely used for two people with ventilation, privacy, equipment, and health concerns. Capacity failure does not convert these conditions into freely chosen cooperation.
Legal classification does not settle justification
Entering a duress credential after seizure or after an evidence-preservation duty attaches may expose a user to allegations of evidence destruction, tampering, or obstruction. That legal risk is real. It does not answer the separate moral question whether a person must preserve a private archive for an institution using prolonged isolation to obtain self-incriminating cooperation.
The ethical case for resistance is strongest when:
- detention or threatened violence supplies the “consent”
- isolation exceeds accepted human-rights limits
- extraction is broad rather than tied to specified evidence
- investigators lack the technical method to interpret the resulting data reliably
- the device contains third-party confidences or material unrelated to the allegation
- the institution offers no independent, timely way to challenge scope or coercion
The case is weaker when evidence is already under a clear preservation duty, access is narrowly and independently authorized, the investigation concerns grave imminent harm, and destruction would chiefly prevent protection of another person.
Product-value boundary
A privacy business can support an operating system that gives the owner a duress control without deciding when the owner should use it. That is consistent with supporting locks, encryption, local deletion, and user-owned recovery credentials.
The business boundary should be institutional rather than moralizing:
- disclose what the upstream feature does and that it is irreversible
- leave activation and the credential entirely to the customer
- retain no master access, remote trigger, or record of the credential
- warn that use can create serious legal and physical risk
- do not offer individualized instructions for destroying evidence in a known investigation
- refer case-specific preservation and criminal-process questions to counsel
- do not market the feature as immunity from lawful process
This boundary protects customer autonomy without turning the seller into an operator of evidence destruction. It also avoids the opposite error: removing a general safety feature because one possible use could be unlawful.
Ethics of resisting lawful extraction supplies the broader framework. Mobile-device extraction and evidentiary selection explains why surrendering a whole device is not epistemically equivalent to producing one known document.
- Find Swedish cases addressing duress wipes, device deletion, or obstruction after seizure.
- Obtain case-specific evidence connecting continued restrictions to demands for device access.