There’s a lot of love all over the world for GrapheneOS, the gold standard of mobile security. There’s very little love between the two guys at the center of its history.
Other opinions didn’t matter—but that didn’t stop them from coming. GrapheneOS eventually hit 400,000 users, and each seemed to have their own unwavering take on how things should work. Having spent so much time fighting for the purity of CopperheadOS, it’s reasonable to assume that Micay felt especially protective of GrapheneOS. Whenever someone would challenge his implementation—especially those who compared GrapheneOS to CalyxOS, a competing Android OS—he would get into strongly worded debates about technical intricacies.
In turn, users fought back. A couple people made videos “exposing” their private conversations with Micay; others made a show of deleting GrapheneOS. The GrapheneOS team itself was accused of going after competing projects and dissenting parties. (Donaldson has called these “campaigns of harassment.”) Wilson told me that education and awareness are cornerstones of GrapheneOS’s work. If you’re not up for the heated debates and lengthy discussion threads, he said, just “buy an iPhone.”
For all their intensity, the flame wars seemed contained to the internet. But on April 23, 2023, there was a knock on Micay’s door. Fully armed policemen were standing outside. They were told, according to Wilson, that “Daniel is armed and he’s gonna shoot everyone that will enter.” Micay had been swatted. It happened two more times, his lawyer said.
Seemingly shaken from the experience, Micay scaled back his responsibilities at GrapheneOS. He continues to consult and occasionally contributes to the project but has relinquished control to his team members. Micay has also scrubbed much of his digital footprint from the internet, leaving a conspiracy-sized gap in the debris of his past battles.
It’s easy to boil the saga of GrapheneOS down to a handful of tweets and internet hearsay, but the strength of its tech was—and remains—hard to ignore. Last year, 404 Media reported on leaked documents from Cellebrite, a software that helps retrieve data from locked phones. The documents, which detailed Cellebrite’s success rate across different Pixel generations, found that “every locked Pixel 9 running GrapheneOS was inaccessible.”
“There are no real alternatives,” says Joe, a GrapheneOS power user and “the most privacy-paranoid person in the room.” I got in touch with him through a Morke.org address, an email service known to operate on the dark web. Joe, a college student, submits his assignments in person to avoid portals and only pays in cash. He tells me about vibrant pockets of the dark web dedicated to evangelizing homebrew privacy solutions—an emergent movement of resistance at a time when Meta plans to remove end-to-end encryption on Instagram DMs, automakers are openly selling driving data to insurance companies, and gait system technology could soon be used to identify civilians from their walk on the streets of New York City. “They have warheads,” Joe says. “We have the inflatable hammer that squeaks.”
GrapheneOS finds itself in the middle of this moment. In the six months I spent talking to its team members, Micay’s aura of mystery started to fade. The ghostly internet hero-villain who’d do whatever it took to make his point became just another guy passionate about security tech. But from Wilson—whom I was messaging with, at one point, for several hours a week—I got rare glimpses into the inner workings of the GrapheneOS operation. It became, in some ways, more mysterious. “Dave Wilson,” for one thing, is not his real name. (Some suspect he’s actually Micay, though he denies this.) In fact, almost no one at the company seems to know where their colleagues live or what they look like. They are bound by a single mission: privacy, theirs and everyone else’s.
