A user says he was reported to police for running GrapheneOS — the thread isn't buying it

The image that read like a dystopia

The story started on Reddit: a user posted a screenshot of an email, supposedly from age-verification vendor Yoti, encountered while trying to clear an age check for a Sony/PSN account on a GrapheneOS phone — a hardened, de-Googled Android build. The quoted line was chilling: devices running GrapheneOS are "automatically reported to both the authorities and our security team." Owning the wrong operating system, in other words, as probable cause.

It's a perfect outrage object, and the HN thread hit 438 points fast. The source, though, is a screenshot of an email on a since-hidden Reddit account — not a vendor statement, not a news report. That matters.

What the email actually said — and why the wording falls apart

One commenter went back to the original images and reconstructed the full message, which makes the "reported for using GrapheneOS" reading look like a misplaced comma more than a policy.

"Due to past security concerns, Yoti automatically flags multiple verification attempts and any devices running GrapheneOS. These instances are automatically reported…" … So the "and" looks like a typo, otherwise their system wouldn't have allowed more than one attempt from a GrapheneOS device to begin with. — Karl Stenerud, who builds the open-source yoloAI tool

His read: the trigger is multiple verification attempts — and that GrapheneOS line is a clumsy aside, not the cause. The system clearly let the user try more than once, which it wouldn't have if the OS alone were an instant ban.

The original poster had a hidden history of poking these systems

The bigger reframe came when a commenter dug into the Reddit author's posting history before it was scrubbed.

"The OP of this reddit post has a lot of other posts (now hidden) about age verification, bypassing it, and privacy … it feels like this guy has been testing how far he can push these various age verification companies with bypass attempts, and as a result got banned. Additionally the email response from the company could have been trivially edited…" — a commenter who tracked the poster's Reddit history

So the most plausible version isn't "innocent privacy user persecuted by the state." It's "person repeatedly probing an age-gate gets flagged by that vendor's fraud system" — with an email whose exact wording can't be verified and whose 'authorities' may never have heard a word.

Why the paranoia still resonates

None of this means the fear is irrational. One commenter described what police actually treated as suspicious after raiding his home:

"the officer in charge told me that the following are things they consider to be suspicious: 1. Use of MEGA … 2. Use of virtual machines 3. 'Having Tor on my computer' … They're fucking clueless, don't underestimate how little they understand." — an Australian whose house was raided by police in 2022

That's the real story under the headline. A single unverifiable screenshot doesn't prove a vendor is snitching on privacy-phone owners. But the speed with which 438 people believed it tells you exactly how much trust ordinary users have left — and the receipts here point at an edited boilerplate email, not a police report.