Dutch Raids and German Extraction Target Pixels Labeled GrapheneOS

Police seized phones from a Ridderkerk reseller’s customers while a Hamburg case produced data from one Pixel 8a. Official builds remain distinct from the modified systems under investigation.

Dutch police conducted nationwide raids in late October 2026, concentrated around Rotterdam, searching for Google Pixel phones. A 42-year-old reseller from Ridderkerk was arrested and held on suspicion of money laundering and participation in a criminal organization. Lawyers reported that some people searched were told they were not suspects; officers were primarily after the devices. AD.nl headlined the operation “Panic in the underworld: police raid en masse looking for Google Pixel phones” and described the phones as popular among criminals. GrapheneOS and a defense analysis state the devices in question ran a reseller’s own fork that included remote-management software and lacked current official security updates. That is not the same as up-to-date GrapheneOS obtained from the project’s site.

In a Hamburg case the German Federal Criminal Police Office extracted data from a seized Pixel 8a that police documentation described as running GrapheneOS. An earlier attempt had failed. The later extraction was processed with Cellebrite tools. Available documents do not state the method used, the device’s patch level, whether it was in Before-First-Unlock or After-First-Unlock state, or how officials confirmed the installation was official GrapheneOS rather than a fork. Leaked Cellebrite capability matrices have shown current GrapheneOS builds on recent Pixels resisting the company’s standard extraction methods more effectively than stock Android, particularly before first unlock. Public reporting has not confirmed remote compromise of an up-to-date official GrapheneOS device.

Gaël Duval, CEO of Murena and founder of the /e/ Foundation, has publicly distinguished his project’s approach from hardened security. In a video and in a Clubic interview he stated that his project was not building a phone “for pedophiles so they can evade justice” and framed strong exploit resistance as outside the product’s goals. GrapheneOS has characterized these and similar remarks as false claims that GrapheneOS is mainly useful to or used by criminals. The statements are on record. Whether they form part of a coordinated state campaign is an inference, not a documented fact.

No public evidence has established a coordinated, state-funded misinformation campaign directed at GrapheneOS by Dutch or German authorities. Police targeting of specific devices used in criminal investigations, and media coverage that emphasizes criminal use, are documented. Claims that Jolla, Volla, Murena, and iodé are effectively backdoored, systematically lack critical patches, or are building an EU Play Integrity API as an anti-privacy tool remain assertions requiring independent technical verification. Predictions that the EU will outlaw secure devices and un-backdoored end-to-end encryption are speculative. Proposals for client-side scanning and expanded law-enforcement access have been debated for years without producing a general ban on hardened operating systems.

GrapheneOS is an open-source Android distribution that adds exploit mitigations, stricter sandboxing, and features such as a duress PIN. It is used by privacy-conscious individuals and, in some documented cases, by people under criminal investigation. Conflating official builds with reseller forks that add remote management, or treating every successful forensic extraction of a Pixel as proof that current GrapheneOS has been broken, is inaccurate. The Dutch raids and the Hamburg extraction are concrete events. The larger claim of a state-sponsored campaign to scare users onto weaker devices remains an assertion rather than a demonstrated fact.