AJ Voss

VC fellow majoring in Finance | Chasing an impactful and fulfilling life | INTJ sp 3w4 | Reject Convenience

[reason @reason]

A federal judge says a warrantless Flock search violated a driver's Fourth Amendment rights https://t.co/Lz3E2W0f6l

[DeFlock @therealDeFlock]

Just getting warmed up.

#Flock #DeFlock #Surveillance #Axon #AxonAxoff

https://t.co/LhZvybLezb

[W.E.B. DaBoi @Tyre_94]

Y’all are not prepared for what’s coming

[AJ Voss @AJS_VC]

@clikengle @fsb_101_ Seriously lol

[theleahfiles @leahfiles]

They tell you Flock cameras are there to fight crime.

So I pulled the actual police logs from my new favorite website (haveibeenflocked . com). 233 million searches that they have been able to get via FOIA requests and here's what "fighting crime" actually looks like:

> 84% had no case number at all
> The most common reason a cop typed in the box? Blank, nothing
> Only about 9% were even tagged as a real crime.
> "Test" and "training" show up as reasons, run on real people's cars
> The FBI and Homeland Security were wired into local camera networks your town never signed off on.

So what is Flock?

FLOCK: 100,000+ plate cameras bolted to poles across America. They read your plate everywhere you drive and never forget.

NOVA: Flock's AI that turns your plate into you. Your name, address, family, everyone you know, in seconds, no warrant.

SIGNALTRACE: a competitor's tool that tracks the Bluetooth off your phone, your AirPods, your watch. Doesn't even need your plate.

Then I followed the money and the lead investor behind Flock also funds an Israeli company that can hack cameras and change the footage. Another lead investor backs a 911 app that flips on your phone's camera and mic. Trace it all the way back and you hit a former Israeli prime minister and Jeffrey Epstein's money.

Full article with photos and receipts is on my Substack now (link in bio). Enjoy!

[GrapheneOS @GrapheneOS]

https://t.co/fSCUYxV9OB

This proposal wouldn't hide that a wipe occurred and would help adversaries exploit and recover data from the device. It isn't a new idea and people have proposed variations of this hundreds of time for years. These proposals wouldn't hold up against widely available forensic software. Giving an attacker access to a decoy profile would make it far easier for them to exploit the device. Without a shut down or reboot, a device was previously in After First Unlock state would be very vulnerable to having data extracted.

GrapheneOS has strong protection against data extraction without depending on a duress PIN/password. The default enabled protections combined with a strong passphrase and 2nd factor fingerprint PIN would have provided fantastic protection for the data on the device. Reducing the device auto-reboot timer would be even better. The secure element would have protected the data with only a random 6 digit PIN instead of a passphrase in practice too.

All of our features are designed to work against adversaries aware of GrapheneOS. Our duress PIN/password is no different. Adversaries aware of GrapheneOS face a dilemma about whether a PIN/password provided by the user is going to unlock the device or wipe it. It wasn't designed around being a secret resulting in an unpleasant surprise for an adversary. We also plan to provide it as part of secure element rate limiting on future devices built to run GrapheneOS to prevent bypassing it with an OS exploit.

Triggering our duress PIN/password feature wipes both hardware keystores, the secure element as a whole and disk encryption metadata. Each of these 3 steps is enough on their own to reliably wipe material needed to obtain the key encryption keys for disk encryption. It happens nearly instantly and it wouldn't be secure if it took a bunch of time or depended on actually erasing any of the encrypted data. Shutting down the device triggers clearing sensitive data from RAM and registers to complete the process. It's necessary to clear a lot of sensitive data from memory and registers including decrypted encryption keys in TEE memory.

Giving an adversary access to a profile on the device instead of shutting down or rebooting would be very problematic. It would give them an immense amount of attack surface for exploiting the device to recover sensitive user data. If the Owner user is in After First Unlock state, the adversary has given massive attack surface for exploiting the device to obtain all of the data from the main user. It would be the extreme opposite of the attack surface reduction and exploit protections provided by GrapheneOS.

GrapheneOS and apps running on it could continue to function indefinitely after the key derivation material is wiped. It already has disk encryption keys loaded into Trusted Execution Environment memory and is using those for inline disk encryption via wrapped keys. Only functionality depending on hardware keys would be broken. If there were profiles in After First Unlock state those would still be available. An attacker exploiting the device would recover the same data as before wiping the key encryption keys.

Forensic data extraction companies have access to GrapheneOS and we don't have access to their software. We cannot rely on security through obscurity or knowing how their software works including which vulnerabilities they exploit. Fooling widely available forensic software into believing a decoy profile is the Owner user isn't feasible. It would need to provide a fully functional Android Debug Bridge (ADB) environment which is completely impractical.

People should consider the fact that they likely haven't thought about this nearly as much as us. There are good reasons for why we designed this feature the way we did and it's working as intended in the real world. The feature becoming widely known about is a requirement for it to work as intended by creating a dilemma for adversaries. The main thing we need now is secure element support for it which we can get implemented for future devices as part of our Motorola Mobility partnership and future OEM partnerships.

[International Cyber Digest @IntCyberDigest]

‼️🚨 ALARMING: Google now treats privacy as suspicious behavior by default. Users of GrapheneOS, CalyxOS, /e/OS, and other deGoogled Android phones are being locked out of millions of websites unless they install the exact Google Play Services software they deliberately removed.

GrapheneOS is recommended by the EFF and used by journalists, lawyers, and activists in high-risk environments. The audience most likely to read Google's data practices and refuse its terms is now flagged as fraudulent for that exact decision.

What happened?:
▪️ Google announced "Cloud Fraud Defense" at Cloud Next on April 22-23, 2026, branding it "the next evolution of reCAPTCHA." Existing reCAPTCHA customers were auto-migrated.
▪️ When the system flags traffic as suspicious, the old click-the-bus puzzle is gone. Users get a QR code instead.
▪️ Scanning the QR code requires Google Play Services running on the device. Internet Archive snapshots show this requirement has been live since at least October 2025, silently rolled out for 7 months before anyone noticed.
▪️ No Play Services = no QR scan = locked out.

The bigger picture:
▪️ Google already tried this in 2023. It was called Web Environment Integrity (WEI), and it would have let Google decide which devices were "real enough" to access the web. Standards bodies and the public pushed back hard, and Google killed it. Three years later, the same idea is back, just hidden behind a QR code instead of a browser feature.
▪️ reCAPTCHA runs on millions of websites. Every developer who keeps using it is now, by default, telling deGoogled Android users they're not welcome...

[TheFuzzStone @thefuzzstone]

I've been a GrapheneOS user ever since the Pixel 6.

And I'm surprised by people who are outraged that Volkswagen has blocked its app from running on GrapheneOS.

Why don't people “vote” with their actions?

For example, maybe you shouldn't buy modern crap - mistakenly called a car - that requires a proprietary app to track you?

[Vinod Khosla @vkhosla]

A lot of creativity going on in robotics. Cool hands.

[AJ Voss @AJS_VC]

@GimmickSlop Which Simpsons episode is that

[AJ Voss @AJS_VC]

@bilalfarooqui Vinod!!! Arthur rocks though lol

[Reads with Ravi @readswithravi]

Just me? 📚📚

[Brian Halligan @bhalligan]

I don't remember where I found this, but its spot on.

[AJ Voss @AJS_VC]

@MonroeEjiogbe @safossatti Seriously lol

[AJ Voss @AJS_VC]

@AdamDraper I was watching Silicon Valley and thinking the same thing lol

[AJ Voss @AJS_VC]

@AdamDraper My feelings exactly

[AJ Voss @AJS_VC]

@Steezehuman Sandra Bullock after going to the same plastic surgeon as Jim Carrey

[AJ Voss @AJS_VC]

@adamshuaib Extensive experience and domain specialization sometimes constrict neuroplastic potential! When one embarks upon challenges with an uncorrupted mind, free of shackles of 'best practices,' 'industry standards,' and 'protocols' - Innovative thinking begins!

[Kyle Harrison @kwharrison13]

This photo deserves a Pulitzer.

[AJ Voss @AJS_VC]

@SamerTheFutureM @chutneylife I mean this with no respect - an 18yo has no idea what they are doing. Brain is not fully developed. People exploiting an 18-23yo woman in the porn industry should be arrested.