Law enforcement claims tying Pixel phones and GrapheneOS to crime, and the disputes around them

GrapheneOS, a privacy-hardened operating system that supports only Google Pixel phones, has been tied to criminal investigations by law enforcement in Spain, France and Canada again and again since 2025. Between 31 October and 1 November its official account posted a series of messages on Mastodon alleging a state-sponsored misinformation and smear campaign in the Netherlands and Germany, while calling The Globe and Mail's September article fair and balanced. As of 2 November, none of the material we found included any notice asking people to change phone system settings, so our judgement is that readers who use a Pixel do not need to change anything. On the same day we also found no similar public statement from law enforcement in Asia.

According to The Globe and Mail's 21 September report, a key phone seized in connection with a series of shootings in Toronto runs GrapheneOS, and investigators had not been able to unlock it by the time of the report, which has held up the investigation. The only source for this is one police source, who is not authorized to discuss the case and whom the paper does not identify. The Toronto Police Service replied that it cannot comment on the status of a particular forensic examination, and a spokesperson added that law enforcement needs appropriate lawful tools to keep pace with encryption.

The report also says that Toronto's police chief publicly supports Bill C-22, which was before Canada's federal Parliament at the time of the 21 September report. The bill would require electronic service providers to help intercept data, and tech companies and civil liberties advocates have opposed it.

Similar claims appeared as early as July 2025. Xataka Android relayed a report by the Catalan outlet Ara in which an anti-drug official in the Catalan police said that every time they see a Pixel, they think it could be a drug trafficker. A security expert quoted in the article put this down to the fact that a Pixel lets its owner freely install another operating system.

The French version came in November 2025. According to Clubic's account of a Le Parisien report, cybersecurity analysts at France's judicial police sent an internal alert about GrapheneOS to other law enforcement services. The alert describes GrapheneOS as initially presented for legitimate uses, protecting citizens against intrusions on their phones, before gradually spreading to users who above all want to escape any collection or analysis of their devices' data by the authorities, including in judicial proceedings. According to Privacy Guides, GrapheneOS then announced it was ending its operations in France and moving its servers away from the French hosting company OVH.

Perspective

According to GrapheneOS's official FAQ, supported devices are chosen against a list of requirements. These include full hardware security functionality when running an alternate operating system, verified boot (a check at startup that the system has not been altered) and complete monthly security patches without any regular delay longer than a week. The FAQ states that the Pixel 8 through the Pixel 10a meet them, and these are requirements GrapheneOS sets for itself, not a third-party verification. The Pixel itself is an ordinary retail phone, sold on the Google Store in Taiwan, Japan and Singapore among other places.

Who uses GrapheneOS is where the accounts differ most. According to GIGAZINE's account of GrapheneOS's July 2025 response, the majority of criminals use iOS or Android, and the proportion of criminals among GrapheneOS users may be even lower than on Android. In the material we found, no party has published statistics on who makes up the user base. An EFF technologist interviewed by The Globe and Mail said there are many reasons to choose GrapheneOS, and that they have nothing to do with whether someone is committing crimes.

Accounts of whether the phones can be unlocked do not agree either. GrapheneOS's statement to The Globe and Mail, sent through its lawyer, says the system is designed so that the project itself cannot bypass its security protections, and that there are no backdoors, master keys or remote access capabilities. The report interviewed a retired Royal Canadian Mounted Police (RCMP) officer who runs a digital forensics firm, and speaking about phones in general, he said the tools from Cellebrite and Magnet Forensics, two makers of phone forensics tools, can unlock pretty much any phone. Neither company would comment on whether it has ever extracted data from a phone running GrapheneOS, and the RCMP and the FBI also declined to comment.

According to Xataka Android, when the Catalan police cannot break the encryption, they infect suspects' phones with malware under court authorization. The article quotes one line, without naming who said it: against organized crime, "si no metes troyanos, estás muerto" (without trojans, you get nowhere). Some lawyers question the tactic, saying the limits on how far it intrudes on privacy are unclear.

On developers' responsibility, according to Privacy Guides' account of a Le Parisien interview, France's cybercrime prosecutor said that a certain portion of users have a real legitimate interest in protecting their communications. If links to a criminal organization are found and the developers do not cooperate with the law, prosecutors will still take them to court. A GrapheneOS social media post quoted by The Globe and Mail says that GrapheneOS is completely legal and that the project has no obligation to weaken any of its security protections. A University of Toronto professor interviewed in the report said there is no legal prohibition in Canada on using a privacy-focused operating system, and that in some cases it may be essential for political dissidents, activists and journalists.

GrapheneOS's 31 October post said that Murena, the company that develops /e/OS, another de-Googled phone operating system, is directly assisting state anti-privacy campaigns and has repeatedly claimed that GrapheneOS is mainly used by criminals. This is GrapheneOS's claim, and we found nothing else to corroborate it.

One of the examples the post links to is a March 2026 Clubic interview with Murena's founder, in which the passage comes from his answer to a question about whether supporting many phone models comes at the cost of security. He said /e/OS lets its users escape the mass collection of personal data on phones on the market, not help child sex offenders slip under the radar of justice. In the same answer he went on to say that /e/OS is not a system aimed at hardened security that would be useful only to targeted people.

As of 2 November we had found no response from Murena to these posts, and no statement from Google about Pixel phones being linked to crime. A GrapheneOS post on 1 November also said that Dutch law enforcement has spent years overstating its own capabilities and making GrapheneOS's security out to be weaker than it is. We have no verifiable primary source for what law enforcement in the Netherlands and Germany actually said, and what this article says about both countries comes only from GrapheneOS's posts.

None of the material we found includes any notice asking people to change phone system settings, and our judgement is that readers using a Pixel's stock system or already running GrapheneOS do not need to change their settings because of these disputes. According to the official FAQ, some companies sell phones with GrapheneOS preinstalled, and as of 2 November the project was not affiliated with or endorsing any of them. The project recommends buying a supported Pixel and installing it yourself (the web installer needs only a browser with WebUSB support, meaning one that lets a web page connect to the phone over USB), and GrapheneOS's 1 November post also says that companies in the Netherlands sell counterfeit GrapheneOS devices. Our inference is that installing it yourself avoids a tampered system, but does nothing to change how local laws treat seized phones and demands to hand over passwords.

As of 2 November we had not found any public statement from police in mainland China, Hong Kong, Singapore or Taiwan tying encrypted phones or a particular operating system, GrapheneOS included, to crime. Installing GrapheneOS yourself also depends on reaching the project's servers, and according to the installer's code it downloads from releases.grapheneos.org, which the third-party monitor GreatFire found disrupted in mainland China in its last test on 2 October, with only one conclusive test in the preceding 90 days. Mainland China, Hong Kong, Singapore and Taiwan do have rules on what happens after a phone is seized, which apply to any device and are not statements by law enforcement about a particular system. Amended implementation rules gazetted in Hong Kong on 23 March 2026 let police investigating offences endangering national security require a "specified person" to provide the password or decryption method for an electronic device, and failing to comply without reasonable excuse carries a fine of up to HK$100,000 and one year in prison.

Under section 40 of Singapore's Criminal Procedure Code 2010, an officer authorized by order of the Public Prosecutor can require a person to hand over decryption information when investigating an arrestable offence, with a penalty of up to S$10,000, three years in prison, or both. A draft rule on electronic evidence released for public comment by mainland China's Ministry of Public Security on 22 May 2026 lets police, when the holder will not provide account passwords, take measures to obtain them with the approval of a public security official at county level or above. Where not extracting the data immediately could lead to serious consequences such as its loss, the draft lets police obtain the passwords first and complete the approval within 24 hours, and as of 7 October we had found no final version. Taiwan's Code of Criminal Procedure gives the accused the right to remain silent (Article 95) and lets an order be made for the owner or holder of an item subject to seizure to produce it (Article 133), but neither article mentions passwords.

Things to watch next are the progress of Bill C-22 and whether Murena and Google respond. The bill was still before the Canadian Parliament at the time of the 21 September report, and we have not checked its progress since.

When comparing what law enforcement says in different places, on the investigative side it is worth asking whether singling out a phone or an operating system helps solve cases, and whether court-authorized measures are already enough. On the privacy side, it is worth asking whether such claims push ordinary users toward phones with weaker protection, and whether requiring developers to assist would weaken protection for every user.